Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path

影響: go:github.com/labstack/echo/v5 < 5.4.0 → 5.4.0, go:github.com/labstack/echo/v4 < 4.16.0 → 4.16.0

When middleware.Static is mounted globally (e.Use(middleware.Static(...))) and an application relies on a route- or group-level middleware guard to restrict a path that also falls under the served static root, a %2F-encoded request bypasses that guard while the file is still served. This is the same encoding/decoding mismatch fixed for StaticFS/StaticDirectoryHandler in CVE-2026-55677 / GHSA-vfp3-v2gw-7wfq, but the fix did not cover the middleware.Static path. In addition, the StaticConfig.Enab…

在 GitHub Advisory Database 阅读

2026/10/29 04:54，GitHub Advisory Database 发布了“Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path”（类型：漏洞公告）。严重程度为“高危”（high）。相关技术：Go、GitHub。CVE：CVE-2026-118650。