Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files
Priority HIGH 72CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 18 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-22 and the CVSS impact.
Summary
Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path (preserving %2F as-is), while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an attacker to bypass route-level access controls and read static files without authorization. This vulnerability is fixed in 4.15.3 and 5.2.0.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00519 44th percentileScored 2026-11-07
Fix Partial echo (labstack): 4.15.3, 5.2.0github.com/labstack/echo/v5 (Go): 5.2.0+1 more productRed Hat: 17 advisoriesRed Hat: 18 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| labstack | echo | before 4.15.3; 5.0.0 to before 5.2.0 | 4.15.3, 5.2.0 | Patch available | CNA |
| — | github.com/labstack/echo/v5 (Go) | before 5.2.0 | 5.2.0 | Patch available | GHSA-vfp3-v2gw-7wfq |
| — | github.com/labstack/echo/v4 (Go) | before 4.15.3 | 4.15.3 | Patch available | GHSA-vfp3-v2gw-7wfq |
| — | github.com/labstack/echo (Go) | up to 3.3.10 | — | No fix listed | GHSA-vfp3-v2gw-7wfq |
- echo Vendorlabstack Affected before 4.15.3; 5.0.0 to before 5.2.0 Fixed in 4.15.3, 5.2.0 Patch available CNA
- github.com/labstack/echo/v5 (Go) Vendor— Affected before 5.2.0 Fixed in 5.2.0 Patch available GHSA-vfp3-v2gw-7wfq
- github.com/labstack/echo/v4 (Go) Vendor— Affected before 4.15.3 Fixed in 4.15.3 Patch available GHSA-vfp3-v2gw-7wfq
- github.com/labstack/echo (Go) Vendor— Affected up to 3.3.10 Fixed in — No fix listed GHSA-vfp3-v2gw-7wfq
Remediation
- Fix · CNA echo (labstack) Fixed in 4.15.3, 5.2.0
- Fix · GHSA-vfp3-v2gw-7wfq github.com/labstack/echo/v5 (Go) Fixed in 5.2.0 Advisory →
- Fix · GHSA-vfp3-v2gw-7wfq github.com/labstack/echo/v4 (Go) Fixed in 4.15.3 Advisory →
Red Hat 17 advisories
- RHSA-2026:91958 Released 2026-10-28 · Red Hat rating Importantosbuild-composer security update
- Red Hat Enterprise Linux AppStream E4S (v.9.4) osbuild-composer-101.3-4.el9_4.7, osbuild-composer-core-101.3-4.el9_4.7, osbuild-composer-worker-101.3-4.el9_4.7
- RHSA-2026:90493 Released 2026-10-26 · Red Hat rating Importantosbuild-composer security update
- Red Hat Enterprise Linux AppStream AUS (v.8.6) osbuild-composer-46.3-11.el8_6, osbuild-composer-core-46.3-11.el8_6, osbuild-composer-dnf-json-46.3-11.el8_6 +1
- Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) osbuild-composer-46.3-11.el8_6, osbuild-composer-core-46.3-11.el8_6, osbuild-composer-dnf-json-46.3-11.el8_6 +1
- RHSA-2026:90363 Released 2026-10-26 · Red Hat rating Importantosbuild-composer security update
- Red Hat Enterprise Linux AppStream E4S (v.8.8) osbuild-composer-75-12.el8_8, osbuild-composer-core-75-12.el8_8, osbuild-composer-dnf-json-75-12.el8_8 +1
- Red Hat Enterprise Linux AppStream TUS (v.8.8) osbuild-composer-75-12.el8_8, osbuild-composer-core-75-12.el8_8, osbuild-composer-dnf-json-75-12.el8_8 +1
Show 14 more Red Hat advisories
- RHSA-2026:69293 Released 2026-09-21 · Red Hat rating Importantosbuild-composer security update
- Red Hat Enterprise Linux AppStream (v. 9) osbuild-composer-165.1-5.el9_8, osbuild-composer-core-165.1-5.el9_8, osbuild-composer-worker-165.1-5.el9_8
- RHSA-2026:67148 Released 2026-09-14 · Red Hat rating Importantosbuild-composer security update
- Red Hat Enterprise Linux AppStream (v. 8) osbuild-composer-101.5-3.el8_10, osbuild-composer-core-101.5-3.el8_10, osbuild-composer-worker-101.5-3.el8_10
- RHSA-2026:66432 Released 2026-09-11 · Red Hat rating Importantosbuild-composer security update
- Red Hat Enterprise Linux AppStream (v. 10) osbuild-composer-165.1-5.el10_2, osbuild-composer-core-165.1-5.el10_2, osbuild-composer-worker-165.1-5.el10_2
- RHSA-2026:63134 Released 2026-09-03 · Red Hat rating Importantosbuild-composer security update
- Red Hat Enterprise Linux AppStream EUS (v. 10.0) osbuild-composer-134.1-10.el10_0, osbuild-composer-core-134.1-10.el10_0, osbuild-composer-worker-134.1-10.el10_0
- RHSA-2026:61585 Released 2026-08-31 · Red Hat rating Importantosbuild-composer security update
- Red Hat Enterprise Linux AppStream E4S (v.9.2) osbuild-composer-76.1-8.el9_2, osbuild-composer-core-76.1-8.el9_2, osbuild-composer-dnf-json-76.1-8.el9_2 +1
- RHSA-2026:61314 Released 2026-08-31 · Red Hat rating ImportantCluster Observability Operator 1.5.2
- Cluster Observability Operator 1.5 registry.redhat.io/cluster-observability-operator/alertmanager-rhel9, registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9, registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator +10
- RHSA-2026:60391 Released 2026-08-26 · Red Hat rating ImportantRed Hat Advanced Cluster Management for Kubernetes v2.16.4 security update
- Red Hat Advanced Cluster Management for Kubernetes 2.16 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +19
- RHSA-2026:60389 Released 2026-08-26 · Red Hat rating ImportantRed Hat Advanced Cluster Management for Kubernetes v2.15.6 security update
- Red Hat Advanced Cluster Management for Kubernetes 2.15 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-must-gather-rhel9 +19
- RHSA-2026:60386 Released 2026-08-26 · Red Hat rating ImportantRed Hat Advanced Cluster Management for Kubernetes v2.17.1 security update
- Red Hat Advanced Cluster Management for Kubernetes 2.17 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +31
- RHSA-2026:57541 Released 2026-08-20 · Red Hat rating Importantosbuild-composer security update
- Red Hat Enterprise Linux AppStream EUS (v.9.6) osbuild-composer-132.2-10.el9_6, osbuild-composer-core-132.2-10.el9_6, osbuild-composer-worker-132.2-10.el9_6
- RHSA-2026:53530 Released 2026-08-11 · Red Hat rating CriticalMulticluster Global Hub 1.7.2 security update
- Multicluster Global Hub 1.7.4 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
- RHSA-2026:52946 Released 2026-08-10 · Red Hat rating CriticalMulticluster Global Hub 1.8.1 security update
- Multicluster Global Hub 1.8.2 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator
- RHSA-2026:47149 Released 2026-07-28 · Red Hat rating ImportantMulticluster Global Hub 1.7.2 security update
- Multicluster Global Hub 1.7.4 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
- RHSA-2026:44622 Released 2026-07-23 · Red Hat rating ImportantMulticluster Global Hub 1.6.4 security update
- Multicluster Global Hub 1.6.6 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Ceph Storage 5 | Affected | No fix yet: Fix deferred |
| Cluster Observability Operator 1.5 | Fixed | RHSA-2026:61314 |
| Multicluster Global Hub 1.6.6 | Fixed | RHSA-2026:44622 |
| Multicluster Global Hub 1.7.4 | Fixed | RHSA-2026:47149, RHSA-2026:53530 |
| Multicluster Global Hub 1.8.2 | Fixed | RHSA-2026:52946 |
| Red Hat Advanced Cluster Management for Kubernetes 2.15 | Fixed | RHSA-2026:60389 |
| Red Hat Advanced Cluster Management for Kubernetes 2.16 | Fixed | RHSA-2026:60391 |
| Red Hat Advanced Cluster Management for Kubernetes 2.17 | Fixed | RHSA-2026:60386 |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2026:66432 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2026:67148 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2026:69293 |
| Red Hat Enterprise Linux AppStream AUS (v.8.6) | Fixed | RHSA-2026:90493 |
| Red Hat Enterprise Linux AppStream E4S (v.8.8) | Fixed | RHSA-2026:90363 |
| Red Hat Enterprise Linux AppStream E4S (v.9.2) | Fixed | RHSA-2026:61585 |
| Red Hat Enterprise Linux AppStream E4S (v.9.4) | Fixed | RHSA-2026:91958 |
| Red Hat Enterprise Linux AppStream EUS (v. 10.0) | Fixed | RHSA-2026:63134 |
| Red Hat Enterprise Linux AppStream EUS (v.9.6) | Fixed | RHSA-2026:57541 |
| Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) | Fixed | RHSA-2026:90493 |
| Red Hat Enterprise Linux AppStream TUS (v.8.8) | Fixed | RHSA-2026:90363 |
Not affected: 12 products
- Cluster Observability Operator 1.5
- Multicluster Global Hub 1.6.6
- Multicluster Global Hub 1.7.4
- Multicluster Global Hub 1.8.2
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Advanced Cluster Management for Kubernetes 2.15
- Red Hat Advanced Cluster Management for Kubernetes 2.16
- Red Hat Advanced Cluster Management for Kubernetes 2.17
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Virtualization 4
Timeline
- 2026-10-02 Threatist record created from CVE-2026-55677
- 2026-10-03 Alias added: GHSA-vfp3-v2gw-7wfq
- 2026-10-27 Fix available: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) +1 · Red Hat
- 2026-10-29 Fix available: RHSA-2026:90493 · Red Hat
- 2026-10-29 Fix available: RHSA-2026:90363 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:91958 · Red Hat
- 2026-10-30 Fix available: Cluster Observability Operator 1.5.3, Multicluster Global Hub 1.6.6, Multicluster Global Hub 1.7.3 +15 · Red Hat
- 2026-10-30 CVSS score added · Red Hat
- 2026-11-05 Fix available: Cluster Observability Operator 1.5 · Red Hat
- 2026-11-06 Fix available: Multicluster Global Hub 1.7.4 · Red Hat
References
Other 8
- https://github.com/labstack/echo/security/advisories/GHSA-vfp3-v2gw-7wfq
- https://github.com/labstack/echo/pull/3009
- https://github.com/labstack/echo/pull/3011
- https://github.com/labstack/echo/commit/8d1ae9d3360a71672418856d58753af25f2c3986
- https://github.com/labstack/echo/commit/c3fa2a27ff92b2b8db360de614f999ef1da24725
- https://github.com/labstack/echo
- https://github.com/labstack/echo/releases/tag/v4.15.3
- https://github.com/labstack/echo/releases/tag/v5.2.0
More labstack vulnerabilities
- TI-2022-18981 Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the… CVSS 3.1CRITICAL 9.6
- TI-2026-82185 Path decoding mismatch in Echo middleware.Static exposes static files CVSS 3.1HIGH 7.5
- TI-2026-82194 Rate limiter bypass in Echo via spoofed X-Forwarded-For header CVSS 3.1MEDIUM 5.3
- TI-2026-20833 Echo has a Windows path traversal via backslash in middleware.Static default filesystem CVSS 3.1MEDIUM 5.3
- TI-2020-18793 Directory traversal on Windows in github.com/labstack/echo/v4 CVSS 3.1MEDIUM 5.3
- TI-2026-82198 Forwarded scheme headers trusted in Echo, bypassing HTTPS redirect CVSS 3.1MEDIUM 5.9
Sources
- CVE-2026-55677 · CVE Program
- CVE-2026-55677 · NVD
- FIRST EPSS
- GHSA-vfp3-v2gw-7wfq · GitHub Advisory Database · CC BY 4.0
- CVE-2026-55677 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences