CVE-2026-118655: Echo has a Static Middleware Double-Unescape Path Traversal
Commit a9ede66a (PR #3006, issue #2599) silently fixed a path traversal vulnerability in the Echo web framework’s static file middleware.
References
- github.com/advisories/GHSA-xwq5-6cqp-vx96
- github.com/labstack/echo/commit/a9ede66a5a7196411131beb1ee801e75bbaf7ac6
- github.com/labstack/echo/commit/c3fa2a27ff92b2b8db360de614f999ef1da24725
- github.com/labstack/echo/issues/2599
- github.com/labstack/echo/pull/3006
- github.com/labstack/echo/releases/tag/v4.15.3
- github.com/labstack/echo/releases/tag/v5.2.0
- github.com/labstack/echo/security/advisories/GHSA-xwq5-6cqp-vx96
- nvd.nist.gov/vuln/detail/CVE-2026-118655
Code Behaviors & Features
Detect and mitigate CVE-2026-118655 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →