## Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path

- 種別: advisory
- 重大度: high
- 関連技術: go, github
- CVE: CVE-2026-118650
- 公開日時: 2026-10-28T19:54:20.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-375p-5qhx-8wq4)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-375p-5qhx-8wq4

影響: go:github.com/labstack/echo/v5 < 5.4.0 → 5.4.0, go:github.com/labstack/echo/v4 < 4.16.0 → 4.16.0
When middleware.Static is mounted globally (e.Use(middleware.Static(...))) and an application relies on a route- or group-level middleware guard to restrict a path that also falls under the served static root, a %2F-encoded request bypasses that guard while the file is still served. This is the same encoding/decoding mismatch fixed for StaticFS/StaticDirectoryHandler in CVE-2026-55677 / GHSA-vfp3-v2gw-7wfq, but the fix did not cover the middleware.Static path. In addition, the StaticConfig.Enab…