{"affected":[{"product":"echo","source":"CNA: GitHub_M","vendor":"labstack","versions":[{"status":"affected","version":"< 4.16.0"},{"status":"affected","version":">= 5.0.0, < 5.4.0"}]},{"defaultStatus":"unaffected","ecosystem":"Go","packageName":"github.com/labstack/echo/v5","product":"github.com/labstack/echo/v5","source":"OSV GHSA-3pmx-cf9f-34xr","vendor":"","versions":[{"events":[{"introduced":"0"},{"fixed":"5.4.0"}],"lessThan":"5.4.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"Go","packageName":"github.com/labstack/echo/v4","product":"github.com/labstack/echo/v4","source":"OSV GHSA-3pmx-cf9f-34xr","vendor":"","versions":[{"events":[{"introduced":"0"},{"fixed":"4.16.0"}],"lessThan":"4.16.0","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-118654","cwes":["CWE-22"],"description":"Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static file handlers can normalize dot segments after route matching and serve a file through a public static route even though the corresponding direct path is protected by route-level middleware. An unauthenticated attacker can read files that an application intended to protect with route-level middleware, when those files are also reachable through a static filesystem mount after path normalization. This vulnerability is the result of an incomplete fix for CVE-2026-55677. This issue is fixed in 4.16.0 and 5.4.0.","epss":{"date":"2026-11-02","percentile":0.28258,"score":0.00347},"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://github.com/labstack/echo/security/advisories/GHSA-3pmx-cf9f-34xr"}],"kev":null,"metrics":[{"score":5.9,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}],"modifiedAt":1793652207704,"publishedAt":1793217567911,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/labstack/echo/security/advisories/GHSA-3pmx-cf9f-34xr"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/labstack/echo/releases/tag/v4.16.0"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/labstack/echo/releases/tag/v5.4.0"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://github.com/labstack/echo/security/advisories/GHSA-3pmx-cf9f-34xr"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-3pmx-cf9f-34xr"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-3pmx-cf9f-34xr"}],"remediation":[{"kind":"fix","source":"OSV GHSA-3pmx-cf9f-34xr","text":"github.com/labstack/echo/v5 (Go): OSV reports a fixed version 5.4.0. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-3pmx-cf9f-34xr"},{"kind":"fix","source":"OSV GHSA-3pmx-cf9f-34xr","text":"github.com/labstack/echo/v4 (Go): OSV reports a fixed version 4.16.0. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-3pmx-cf9f-34xr"}],"revision":"f881a762ab7fc0275de578484c43b02f10c980ebd32891f223c70ff6c28600ac","sources":[{"modifiedAt":1793652207704,"name":"CNA: GitHub_M","retrievedAt":1793653770071,"url":"https://www.cve.org/CVERecord?id=CVE-2026-118654"},{"modifiedAt":1793222105143,"name":"OSV / GitHub Security Advisories","retrievedAt":1793653771455,"url":"https://osv.dev/vulnerability/GHSA-3pmx-cf9f-34xr"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793653774040,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-118654"}],"ssvc":{"assessedAt":1793652184630,"automatable":"no","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Echo static file middleware route protection bypass via encoded dot-dot traversal","updatedAt":1793653774040}