This PR contains the following updates:

Package	Change	Age	Confidence
github.com/labstack/echo/v5	v5.1.0 → v5.2.0

Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files

CVE-2026-55677 / GHSA-vfp3-v2gw-7wfq

Details

Summary

Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path (preserving %2F as-is), while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an attacker to bypass route-level access controls and read static files without authorization.

Details

Root cause 1 — router.go lines 798-802:
The router uses req.URL.RawPath for route matching when useEscapedPathForRouting is false (the default). This means /admin%2Fsecret.txt is treated as a single path segment and does NOT match the /admin/* route pattern.

if !r.useEscapedPathForRouting && req.URL.RawPath != "" {
    path = req.URL.RawPath
}

Root cause 2 — echo.go lines 559-568:
StaticDirectoryHandler calls url.PathUnescape() on the path parameter before opening files. This converts %2F back to /, resolving admin/secret.txt on disk.

if !disablePathUnescaping {
    tmpPath, err := url.PathUnescape(p)
    p = tmpPath
}
name := filepath.ToSlash(filepath.Clean(strings.TrimPrefix(p, "/")))

PoC (Screenshot)

Sample:

403:

Bypass with encoded slash:

Impact

Unauthorized static file disclosure. Applications that protect route prefixes with authentication middleware while also serving static files from a broader root are vulnerable. An attacker only needs to encode the slash (/ → %2F) in the URL to bypass all route-level protection.

Common affected pattern:

adminGroup := e.Group("/admin", authMiddleware)
e.StaticFS("/", os.DirFS("public"))

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

• https://github.com/labstack/echo/security/advisories/GHSA-vfp3-v2gw-7wfq
• https://nvd.nist.gov/vuln/detail/CVE-2026-55677
• https://github.com/labstack/echo/pull/3009
• https://github.com/labstack/echo/pull/3011
• https://github.com/labstack/echo/commit/8d1ae9d3360a71672418856d58753af25f2c3986
• https://github.com/labstack/echo/commit/c3fa2a27ff92b2b8db360de614f999ef1da24725
• https://github.com/labstack/echo/releases/tag/v4.15.3
• https://github.com/labstack/echo/releases/tag/v5.2.0
• https://github.com/advisories/GHSA-vfp3-v2gw-7wfq

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

v5.2.0

Compare Source

Security

• fix(static): reject encoded path separators that bypass route-level middleware by @​vishr in #​3009
• fix(middleware/static): don't double-unescape request path (#​2599) by @​vishr in #​3006

Fixes GHSA-vfp3-v2gw-7wfq: an encoded path separator (%2F or %5C) in a static file URL could bypass route-level middleware (e.g. authentication on a sibling route) and disclose static files. Both StaticDirectoryHandler/StaticFS and the Static middleware are affected. Thanks to @​a-tt-om and @​oran-gugu for reporting.

Enhancements

• feat(middleware): optional RateLimiterStoreContext for response headers (#​2961) by @​vishr in #​3007
• perf: optimize core hot paths (chain, context, binding, responses) by @​vishr in #​3008
• fix(binder): include field name in bind conversion errors (#​2629) by @​vishr in #​3005
• fix(binder): serialize BindingError to structured JSON (#​2771) by @​vishr in #​3004
• fix(binder): MustUnixTime docs say time.Time, not time.Duration by @​c-tonneslan in #​2988
• fix(middleware): reset ContentLength after gzip decompression by @​shblue21 in #​3000
• fix(middleware/proxy): append RealIP to X-Forwarded-For for WebSocket requests by @​kawaway in #​2994
• Fix proxy panic when balancer has no targets by @​shblue21 in #​2977
• fix(middleware): correct documented KeyAuth KeyLookup default by @​leestana01 in #​2992
• test: lock in v5 group route method-handling (405 + OPTIONS) by @​vishr in #​3003
• docs: liveness signals in README + public ROADMAP by @​vishr in #​3002
• Fix typos in CSRFConfig comments by @​shblue21 in #​2979
• refactor: modernize code usage using gofix by @​kumapower17 in #​2970
• refactor: replace Split in loops with more efficient SplitSeq by @​box4wangjing in #​2969
• refactor: use the built-in max/min to simplify the code by @​criciss in #​2966
• Update GitHub actions deps versions by @​aldas in #​2971

New Contributors

• @​criciss made their first contribution in #​2966
• @​box4wangjing made their first contribution in #​2969
• @​shblue21 made their first contribution in #​2977
• @​c-tonneslan made their first contribution in #​2988
• @​leestana01 made their first contribution in #​2992
• @​kawaway made their first contribution in #​2994

Full Changelog: labstack/echo@v5.1.1...v5.2.0

v5.1.1

Compare Source

Security

• Context.Scheme() should validate values taken from header by @​aldas in #​2953

Thanks to @​shblue21 for reporting this issue.

Enhancements

• Add golangci linter configuration by @​aldas in #​2930
• Make StartConfig listener creation context-aware by @​EricGusmao in #​2936
• fix(lint): resolve staticcheck issues and improve code quality by @​itsllyaz in #​2941
• Context.Scheme should validate values taken from header by @​aldas in #​2953
• chore: fix typos in httperror.go by @​tisonkun in #​2958
• Context.Json should not unwrap response by @​aldas in #​2964

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

• If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.