Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path

影響: go:github.com/labstack/echo/v5 < 5.4.0 → 5.4.0, go:github.com/labstack/echo/v4 < 4.16.0 → 4.16.0

When middleware.Static is mounted globally (e.Use(middleware.Static(...))) and an application relies on a route- or group-level middleware guard to restrict a path that also falls under the served static root, a %2F-encoded request bypasses that guard while the file is still served. This is the same encoding/decoding mismatch fixed for StaticFS/StaticDirectoryHandler in CVE-2026-55677 / GHSA-vfp3-v2gw-7wfq, but the fix did not cover the middleware.Static path. In addition, the StaticConfig.Enab…

Read on GitHub Advisory Database

On 10/29/2026, 04:54 AM, GitHub Advisory Database published "Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path" (type: Advisory). Severity is "High" (high). Related technologies: Go, GitHub. CVE: CVE-2026-118650.