{"id":"ghsa-ghsa-375p-5qhx-8wq4","seq":2056986,"kind":"advisory","title":"Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path","url":"https://github.com/advisories/GHSA-375p-5qhx-8wq4","permalink":"https://vulnpulse.app/items/ghsa-ghsa-375p-5qhx-8wq4","summary":"影響: go:github.com/labstack/echo/v5 < 5.4.0 → 5.4.0, go:github.com/labstack/echo/v4 < 4.16.0 → 4.16.0\nWhen middleware.Static is mounted globally (e.Use(middleware.Static(...))) and an application relies on a route- or group-level middleware guard to restrict a path that also falls under the served static root, a %2F-encoded request bypasses that guard while the file is still served. This is the same encoding/decoding mismatch fixed for StaticFS/StaticDirectoryHandler in CVE-2026-55677 / GHSA-vfp3-v2gw-7wfq, but the fix did not cover the middleware.Static path. In addition, the StaticConfig.Enab…","severity":"high","techs":["go","github"],"cves":["CVE-2026-118650"],"tags":["GHSA-375p-5qhx-8wq4","github.com/labstack/echo/v5","github.com/labstack/echo/v4"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-28T19:54:20.000Z","fetched_at":"2026-10-29T00:48:52.653Z"}