{"id":"CVE-2026-55677","aliases":["GHSA-vfp3-v2gw-7wfq","GO-2026-6293"],"url":"https://o3.security/vulnerability/CVE-2026-55677","summary":"Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files","details":"### Summary\n\nEcho's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path (preserving `%2F` as-is), while `StaticDirectoryHandler` unescapes `%2F` to `/` before resolving filesystem paths. This allows an attacker to bypass route-level access controls and read static files without authorization.\n\n### Details\n\n**Root cause 1 — `router.go` lines 798-802:**\nThe router uses `req.URL.RawPath` for route matching when `useEscapedPathForRouting` is false (the default). This means `/admin%2Fsecret.txt` is treated as a single path segment and does NOT match the `/admin/*` route pattern.\n\n```go\nif !r.useEscapedPathForRouting && req.URL.RawPath != \"\" {\n    path = req.URL.RawPath\n}\n```\n\n**Root cause 2 — `echo.go` lines 559-568:**\n`StaticDirectoryHandler` calls `url.PathUnescape()` on the path parameter before opening files. This converts `%2F` back to `/`, resolving `admin/secret.txt` on disk.\n\n```go\nif !disablePathUnescaping {\n    tmpPath, err := url.PathUnescape(p)\n    p = tmpPath\n}\nname := filepath.ToSlash(filepath.Clean(strings.TrimPrefix(p, \"/\")))\n```\n\n### PoC (Screenshot)\nSample:\n<img width=\"1291\" height=\"970\" alt=\"image\" src=\"https://github.com/user-attachments/assets/0bc58059-3e6d-4678-ab25-a5c79b006738\" />\n\n403:\n<img width=\"526\" height=\"194\" alt=\"image\" src=\"https://github.com/user-attachments/assets/2f55ffdd-87b2-4a1b-8a13-130ebad0f257\" />\n\nBypass with encoded slash:\n<img width=\"592\" height=\"203\" alt=\"image\" src=\"https://github.com/user-attachments/assets/1191cd39-ae8f-4d7e-8fb1-cb9cf31f484f\" />\n\n### Impact\n\nUnauthorized static file disclosure. Applications that protect route prefixes with authentication middleware while also serving static files from a broader root are vulnerable. An attacker only needs to encode the slash (`/` → `%2F`) in the URL to bypass all route-level protection.\n\nCommon affected pattern:\n```go\nadminGroup := e.Group(\"/admin\", authMiddleware)\ne.StaticFS(\"/\", os.DirFS(\"public\"))\n```","published":"2026-06-26T16:15:55.633Z","modified":"2026-10-05T13:26:55.406606724Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"epss":{"score":0.00431,"percentile":0.36496,"asOf":"2026-09-15"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/labstack/echo/v5","fixedVersion":"5.2.0"},{"ecosystem":"Go","name":"github.com/labstack/echo/v4","fixedVersion":"4.15.3"},{"ecosystem":"Go","name":"github.com/labstack/echo","fixedVersion":null}],"fix":{"url":"https://github.com/labstack/echo/pull/3009","label":"labstack/echo#3009"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55677.json"},{"type":"ADVISORY","url":"https://github.com/labstack/echo/security/advisories/GHSA-vfp3-v2gw-7wfq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55677"},{"type":"WEB","url":"https://github.com/labstack/echo/pull/3009"},{"type":"WEB","url":"https://github.com/labstack/echo/pull/3011"},{"type":"WEB","url":"https://github.com/labstack/echo/commit/8d1ae9d3360a71672418856d58753af25f2c3986"},{"type":"WEB","url":"https://github.com/labstack/echo/commit/c3fa2a27ff92b2b8db360de614f999ef1da24725"},{"type":"PACKAGE","url":"https://github.com/labstack/echo"},{"type":"WEB","url":"https://github.com/labstack/echo/releases/tag/v4.15.3"},{"type":"WEB","url":"https://github.com/labstack/echo/releases/tag/v5.2.0"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-05T13:26:55.406606724Z"}}