CVE-2026-118655
Description
A flaw was found in Echo. A remote attacker can access files under guarded routes, leading to unauthorized information disclosure. This issue occurs when the static file middleware is registered globally and decodes request URL paths a second time. By sending requests containing double-encoded path separators, an attacker can bypass path restrictions and retrieve files from the server.
Statement
This vulnerability is rated as Moderate because exploitation requires an uncommon application design where static file serving is applied globally across all routes, and the impact is confined to unauthorized file reading under guarded endpoints without enabling system modification or code execution. In Red Hat environments deploying services built with the Echo framework, applications are not exposed if file handlers are scoped to specific prefix paths rather than attached to the root router. Furthermore, directory traversal cannot escape beyond the designated root boundary, restricting potential exposure strictly to protected assets located within that file hierarchy.
Understanding the Weakness (CWE)
Confidentiality,Integrity,Access Control
Technical Impact: Read Files or Directories; Modify Files or Directories; Bypass Protection Mechanism
An attacker may be able to traverse the file system to unintended locations and read or overwrite the contents of unexpected files. If the files are used for a security mechanism than an attacker may be able to bypass the mechanism.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
