CVE-2026-118650
Description
A flaw was found in Echo. This vulnerability allows a remote attacker to cause information disclosure by sending specially crafted HTTP requests containing encoded characters. Because the framework router and the static file handler interpret encoded paths differently, an attacker can bypass route restrictions and retrieve unauthorized files hosted on the server.
Statement
This vulnerability is rated as Important for Red Hat because remote, unauthenticated attackers can bypass route-level security controls to access sensitive data without requiring privileges or user interaction. Exploitation is constrained to non-standard application architectures where static assets are mounted globally while simultaneously relying on route or group middleware to guard specific files within that same directory tree. The impact is further limited to information disclosure of files residing strictly inside the designated document root, preventing arbitrary file retrieval outside those boundaries.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
