x/vulndb: potential Go vuln in github.com/labstack/echo: GHSA-vfp3-v2gw-7wfq

[GoVulnBot]

Advisory GHSA-vfp3-v2gw-7wfq references a vulnerability in the following Go modules:

Module
github.com/labstack/echo
github.com/labstack/echo/v4
github.com/labstack/echo/v5

Description:

Summary

Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path (preserving %2F as-is), while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an attacker to bypass route-level access controls and read static files without authorization.

Details

Root cause 1 — router.go lines 798-802:
The router uses req.URL.RawPath for route matching when useEscapedPathForRouting is false (the default). This means /admin%2Fsecret.txt is treated as a single path segment and...

References:

• ADVISORY: GHSA-vfp3-v2gw-7wfq
• ADVISORY: GHSA-vfp3-v2gw-7wfq
• ADVISORY: https://nvd.nist.gov/vuln/detail/CVE-2026-55677
• FIX: labstack/echo@8d1ae9d
• FIX: labstack/echo@c3fa2a2
• FIX: fix(static): reject encoded path separator to prevent route-level auth bypass labstack/echo#3009
• FIX: fix(static): reject encoded path separators that bypass route-level middleware (v4 backport) labstack/echo#3011
• WEB: https://github.com/labstack/echo/releases/tag/v4.15.3
• WEB: https://github.com/labstack/echo/releases/tag/v5.2.0

Cross references:

• github.com/labstack/echo/v4 appears in 2 other report(s):
  • data/reports/GO-2021-0051.yaml (dummy issue #51)
  • data/reports/GO-2022-1031.yaml (x/vulndb: potential Go vuln in github.com/labstack/echo/v4: GHSA-crxj-hrmp-4rwf #1031)
• github.com/labstack/echo/v5 appears in 1 other report(s):
  • data/reports/GO-2026-4502.yaml (x/vulndb: potential Go vuln in github.com/labstack/echo/v5: GHSA-pgvm-wxw2-hrv9 #4502)

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/labstack/echo
      vulnerable_at: 3.3.10+incompatible
    - module: github.com/labstack/echo/v4
      versions:
        - fixed: 4.15.3
      vulnerable_at: 4.15.2
    - module: github.com/labstack/echo/v5
      versions:
        - fixed: 5.2.0
      vulnerable_at: 5.1.1
summary: |-
    Echo: Encoded slash (%2F) bypasses route-level protection and exposes static
    files in github.com/labstack/echo
cves:
    - CVE-2026-55677
ghsas:
    - GHSA-vfp3-v2gw-7wfq
references:
    - advisory: https://github.com/advisories/GHSA-vfp3-v2gw-7wfq
    - advisory: https://github.com/labstack/echo/security/advisories/GHSA-vfp3-v2gw-7wfq
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-55677
    - fix: https://github.com/labstack/echo/commit/8d1ae9d3360a71672418856d58753af25f2c3986
    - fix: https://github.com/labstack/echo/commit/c3fa2a27ff92b2b8db360de614f999ef1da24725
    - fix: https://github.com/labstack/echo/pull/3009
    - fix: https://github.com/labstack/echo/pull/3011
    - web: https://github.com/labstack/echo/releases/tag/v4.15.3
    - web: https://github.com/labstack/echo/releases/tag/v5.2.0
source:
    id: GHSA-vfp3-v2gw-7wfq
    created: 2026-08-25T17:02:41.195131061Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/821940 mentions this issue: data/reports: add 2 reports