Priority HIGH 76
Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component.
CVSS 3.1CRITICAL 9.6· Network · No auth · User interaction · EPSS 0.03238 · Published 2022-09-28 · Fixed in 4.9.0 CWE-601
Priority HIGH 72
Echo is a Go web framework.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00396 · Published 2026-10-28 · Fixed in 5.4.0, 4.16.0 CWE-177
Priority HIGH 72
Echo is a Go web framework.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00519 · Published 2026-06-26 · Partial fix · 4.15.3, 5.2.0 CWE-22
Priority MEDIUM 63
Echo is a Go web framework.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00415 · Published 2026-10-28 · Fixed in 5.1.0 CWE-290
Priority MEDIUM 63
Echo is a Go web framework.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00382 · Published 2026-02-19 · Fixed in 5.0.3 CWE-22
Priority MEDIUM 63
Due to improper sanitization of user input on Windows, the static file handler allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01413 · Published 2022-12-07 · Fixed in 4.1.18-0.20201215153152-4422e3b66b9f, 4.2.0 CWE-22
Priority MEDIUM 60
Echo is a Go web framework.
CVSS 3.1MEDIUM 5.9· Network · No auth · User interaction · EPSS 0.00133 · Published 2026-10-28 · Fixed in 5.4.0, 4.16.0 CWE-346
Priority MEDIUM 60
Echo is a Go web framework.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.00347 · Published 2026-10-28 · Fixed in 4.16.0, 5.4.0 CWE-22
Priority MEDIUM 60
Echo is a Go web framework.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00239 · Published 2026-10-28 · Fixed in 4.16.0, 5.4.0 CWE-79
Priority MEDIUM 57
Echo is a Go web framework.
CVSS 3.1MEDIUM 5.3· Network · No auth · User interaction · EPSS 0.00163 · Published 2026-10-28 · Fixed in 4.16.0, 5.4.0 CWE-352
Priority MEDIUM 55
Echo is a Go web framework.
CVSS 3.1MEDIUM 4.7· Network · No auth · User interaction · EPSS 0.00186 · Published 2026-10-28 · Fixed in 5.1.1, 4.15.2 CWE-601
Priority MEDIUM 48
Echo is a Go web framework.
CVSS 4.0CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.0043 · Published 2026-10-28 · Partial fix · 4.16.1, 5.4.1 CWE-444
Priority MEDIUM 42
Echo is a Go web framework.
CVSS 4.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.00372 · Published 2026-10-28 · Fixed in 4.16.1 CWE-400
Priority LOW 36
Echo is a Go web framework.
CVSS 4.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.00372 · Published 2026-10-28 · Fixed in 4.16.1 CWE-400
Priority LOW 35
Echo is a Go web framework.
CVSS 4.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.00302 · Published 2026-10-28 · Fixed in 4.16.1, 5.4.1 CWE-772
Priority LOW 34
Echo is a Go web framework.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00385 · Published 2026-10-28 · Fixed in 5.4.1 CWE-252
Priority LOW 29
Echo is a Go web framework.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00207 · Published 2026-10-28 · Fixed in 5.4.0 CWE-346
Priority LOW 29
Echo is a Go web framework.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00139 · Published 2026-10-28 · Fixed in 5.4.1 CWE-348
Priority LOW 27
Echo is a Go web framework.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00197 · Published 2026-10-28 · Fixed in 5.4.0, 4.16.0 CWE-601
Priority LOW 26
Echo is a Go web framework.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.00303 · Published 2026-10-28 · Fixed in 5.2.0, 4.15.3 CWE-174
THREATIST.IORead the docs