CVE-2026-118654
Description
A flaw was found in Echo. This vulnerability allows an unauthenticated remote attacker to bypass access controls and view protected files. When requests containing dot segments are sent to public static file handlers, the application normalizes the path after route matching has occurred, enabling the attacker to retrieve files that were intended to be restricted by route-level middleware.
Statement
Moderate severity is assigned to this vulnerability because successful exploitation requires a specific application architecture where public static handlers serve from directory hierarchies containing sensitive files guarded by middleware. In Red Hat environments, Go services embedding Echo are only exposed if publicly reachable static filesystem mounts overlap with restricted route paths. Without this overlapping directory layout, path traversal sequences using encoded dot-dot segments cannot access protected assets.
Understanding the Weakness (CWE)
Confidentiality,Integrity,Access Control
Technical Impact: Read Files or Directories; Modify Files or Directories; Bypass Protection Mechanism
An attacker may be able to traverse the file system to unintended locations and read or overwrite the contents of unexpected files. If the files are used for a security mechanism than an attacker may be able to bypass the mechanism.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
