TI-2026-82199 CVE-2026-118658 · GHSA-23wf-92cp-8pcj
Arbitrary scheme injection in Echo WWWRedirect and NonWWWRedirect
Priority MEDIUM 55
Echo is a Go web framework.
Vulnerabilities
20 records
TI-2026-82198 CVE-2026-118657 · GHSA-2ffq-g2xg-c22p
Forwarded scheme headers trusted in Echo, bypassing HTTPS redirect
Priority MEDIUM 60
Echo is a Go web framework.
TI-2026-82197 CVE-2026-118656 · GHSA-v753-g4cw-jm48
Open redirect in Echo Go framework via control-character prefix
Priority LOW 27
Echo is a Go web framework.
TI-2026-82196 CVE-2026-118655 · GHSA-xwq5-6cqp-vx96
Path traversal in Echo Go framework static middleware
Priority LOW 26
Echo is a Go web framework.
TI-2026-82195 CVE-2026-118654 · GHSA-3pmx-cf9f-34xr
Path traversal in Echo static file handlers bypasses route middleware
Priority MEDIUM 60
Echo is a Go web framework.
TI-2026-82194 CVE-2026-118653 · GHSA-246p-cpwv-v3jq
Rate limiter bypass in Echo via spoofed X-Forwarded-For header
Priority MEDIUM 63
Echo is a Go web framework.
TI-2026-82187 CVE-2026-118652 · GHSA-h9g5-28mm-hx3g
Reflected cross-site scripting in Echo Go framework JSONP callback
Priority MEDIUM 60
Echo is a Go web framework.
TI-2026-82186 CVE-2026-118651 · GHSA-99jh-6h7p-pp36
Echo reverse proxy forwards spoofed X-Real-IP header upstream
Priority LOW 29
Echo is a Go web framework.
TI-2026-82185 CVE-2026-118650 · GHSA-375p-5qhx-8wq4
Path decoding mismatch in Echo middleware.Static exposes static files
Priority HIGH 72
Echo is a Go web framework.
TI-2026-82184 CVE-2026-118266 · GHSA-r7w9-592q-9vg4
CSRF bypass in Echo via MethodOverride rewriting POST requests
Priority MEDIUM 57
Echo is a Go web framework.
Priority LOW 29
Echo is a Go web framework.
Priority MEDIUM 48
Echo is a Go web framework.
Priority LOW 34
Echo is a Go web framework.
Priority LOW 35
Echo is a Go web framework.
Priority LOW 36
Echo is a Go web framework.
TI-2026-82147 CVE-2026-118260
Unbounded memory use in Echo BodyDump middleware
Priority MEDIUM 42
Echo is a Go web framework.
TI-2026-40198 CVE-2026-55677 · GHSA-vfp3-v2gw-7wfq
Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files
Priority HIGH 72
Echo is a Go web framework.
TI-2026-20833 CVE-2026-25766 · GHSA-pgvm-wxw2-hrv9
Echo has a Windows path traversal via backslash in middleware.Static default filesystem
Priority MEDIUM 63
Echo is a Go web framework.
TI-2020-18793 CVE-2020-36565 · GHSA-j453-hm5x-c46w
Directory traversal on Windows in github.com/labstack/echo/v4
Priority MEDIUM 63
Due to improper sanitization of user input on Windows, the static file handler allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read.
TI-2022-18981 CVE-2022-40083 · GHSA-crxj-hrmp-4rwf
Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the…
Priority HIGH 76
Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component.