{"affected":[{"product":"echo","source":"CNA: GitHub_M","vendor":"labstack","versions":[{"status":"affected","version":">= 5.0.0, < 5.4.0"},{"status":"affected","version":"< 4.16.0"}]},{"defaultStatus":"unaffected","ecosystem":"Go","packageName":"github.com/labstack/echo/v5","product":"github.com/labstack/echo/v5","source":"OSV GHSA-375p-5qhx-8wq4","vendor":"","versions":[{"events":[{"introduced":"0"},{"fixed":"5.4.0"}],"lessThan":"5.4.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"Go","packageName":"github.com/labstack/echo/v4","product":"github.com/labstack/echo/v4","source":"OSV GHSA-375p-5qhx-8wq4","vendor":"","versions":[{"events":[{"introduced":"0"},{"fixed":"4.16.0"}],"lessThan":"4.16.0","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-118650","cwes":["CWE-177","CWE-863"],"description":"Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally mounted middleware.Static instance can interpret an encoded request path differently from Echo's router because the router matches the still-encoded path while the static handler uses the decoded URL.Path. The advisory demonstrates an encoded slash resolving to a file under the static root through the global static middleware, but the source is internally inconsistent about whether a route or group guard protects the corresponding literal path in that global-mount configuration. This issue is fixed in 4.16.0 and 5.4.0.","epss":{"date":"2026-11-02","percentile":0.33861,"score":0.00396},"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://github.com/labstack/echo/security/advisories/GHSA-375p-5qhx-8wq4"}],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}],"modifiedAt":1793652036530,"publishedAt":1793215502952,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/labstack/echo/security/advisories/GHSA-375p-5qhx-8wq4"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/labstack/echo/releases/tag/v4.16.0"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/labstack/echo/releases/tag/v5.4.0"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://github.com/labstack/echo/security/advisories/GHSA-375p-5qhx-8wq4"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-375p-5qhx-8wq4"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-375p-5qhx-8wq4"}],"remediation":[{"kind":"fix","source":"OSV GHSA-375p-5qhx-8wq4","text":"github.com/labstack/echo/v5 (Go): OSV reports a fixed version 5.4.0. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-375p-5qhx-8wq4"},{"kind":"fix","source":"OSV GHSA-375p-5qhx-8wq4","text":"github.com/labstack/echo/v4 (Go): OSV reports a fixed version 4.16.0. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-375p-5qhx-8wq4"}],"revision":"a0aa81af054c5f4cfc99bd1a00a97a67130f502981f71bb67a093e15a7f4d8bb","sources":[{"modifiedAt":1793652036530,"name":"CNA: GitHub_M","retrievedAt":1793653767850,"url":"https://www.cve.org/CVERecord?id=CVE-2026-118650"},{"modifiedAt":1793218505439,"name":"OSV / GitHub Security Advisories","retrievedAt":1793653769372,"url":"https://osv.dev/vulnerability/GHSA-375p-5qhx-8wq4"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793653774992,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-118650"}],"ssvc":{"assessedAt":1793652000138,"automatable":"yes","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path","updatedAt":1793653774992}