CVE-2026-55677High· 7.5▾ TwilightA flaw was found in Echo, a Go web framework. An attacker can exploit a disagreement in URL path decoding between the router and the static file handler. The router processes raw encoded paths, while the static file handler unescapes encod…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.4%
Last analysed / modified upstream
A flaw was found in Echo, a Go web framework. An attacker can exploit a disagreement in URL path decoding between the router and the static file handler. The router processes raw encoded paths, while the static file handler unescapes encoded forward slashes. This allows an attacker to bypass route-level access controls, leading to unauthorized information disclosure by reading static files.
github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy — rated Important by Red Hat. Released 2026-06-26, updated 2026-09-21.
Affected:
Fixed:
No fix planned:
Not affected:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:63134 For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:66432 For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:67148
Workarounds / mitigations:
Affected packages:
github.com/labstack/echo/v5 < 5.2.0github.com/labstack/echo/v4 < 4.15.3github.com/labstack/echo <= 3.3.10Patched in:
github.com/labstack/echo/v5 5.2.0github.com/labstack/echo/v4 4.15.3Connected by shared product, vendor, weakness, or advisory.
CVE-2026-15801High· 8.0A vulnerability was found in CRI-O related to the container checkpoint and restore feature
CVE-2023-27534Low· 3.7curl: SFTP path ~ resolving discrepancy (CVE-2023-27534)
CVE-2026-81829Medium· 5.3A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers
CVE-2026-79705Medium· 4.5A flaw was found in the buildah/copier Go package
CVE-2025-59682High· 8.8django: Potential partial directory-traversal via archive.extract() (CVE-2025-59682)
CVE-2025-6020High· 7.8A flaw was found in linux-pam