v4 backport of #3009 (released in v5.2.0) for GHSA-vfp3-v2gw-7wfq.

Summary

An encoded path separator (%2F or %5C) in a static file URL could bypass route-level access control and disclose files. The router matches against the raw, still-encoded path, so %2F is not a separator — /admin%2Fsecret.txt skips a protected /admin/* group, falls through to static serving, which then unescaped %2F→/ and served admin/secret.txt.

v4 is affected on both static surfaces:

• echo_fs.go StaticDirectoryHandler (used by Static/StaticFS) — vulnerable to %2F and %5C (it used OS-specific filepath.Clean).
• middleware/static.go — vulnerable to %2F (it already used path.Clean, so not %5C).

Fix

• Both surfaces reject a wildcard containing an encoded separator (%2F/%2f or %5C/%5c) with 404 before unescaping, via a shared internal/pathutil helper.
• StaticDirectoryHandler switched from filepath.Clean+ToSlash to path.Clean (OS-independent; keeps backslash literal on Windows).

Tests

• New regression tests for %2F, %5C, double-encoded %252F, group StaticFS, and the static middleware on a group; unit test for the detector.
• Updated two existing cases (open redirect vulnerability, Directory redirect#01) that asserted the old %2f-unescaped redirect — they now correctly assert 404 + no Location.
• go test -race ./... and go vet ./... pass.

Targets the v4 branch for a v4.15.3 release; the advisory will be amended to add the github.com/labstack/echo (v4) affected product once tagged.

🤖 Generated with Claude Code