| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/labstack/echo/v4 | < 4.15.3 | 4.15.3 |
| github.com/labstack/echo/v5 | < 5.2.0 | 5.2.0 |
Commit a9ede66a (PR #3006, issue #2599) silently fixed a path traversal vulnerability in the Echo web framework's static file middleware.
The static middleware double-unescaped URL paths. Go's net/http already decodes Request.URL.Path, but middleware/static.go unconditionally called url.PathUnescape() again:
// BEFORE (vulnerable)
pathUnescape := true
This reassembled path traversal sequences from double-encoded input. An attacker could send GET /%2e%2e%2fsecret.txt or /..%252fsecret.txt and the double-unescape would produce ../secret.txt.
// AFTER (fixed)
pathUnescape := false
The commit's test TestStatic_percentEncodedTraversalIsBlocked explicitly verifies traversal vectors are blocked.
Arbitrary file read from server filesystem via percent-encoded path traversal.
Fixed in github.com/labstack/echo/v5 v5.2.0 and github.com/labstack/echo/v4 v4.15.3, where the Static middleware stopped unescaping an already decoded path. Maintainer analysis: reading files outside the configured root could not be reproduced; the confirmed impact was that a double-encoded slash (%252F) could reach a file under a guarded route when the Static middleware is registered globally. Upgrade to v5.4.0 / v4.16.0 or later, which also includes related fixes for encoded and dot-segment paths.
Keep files that need protection outside the Static middleware's root directory.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free