Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally mounted middleware.Static instance can interpret an encoded request path differently from Echo's router because the router matches the still-encoded path while the static handler uses the decoded URL.Path. The advisory demonstrates an encoded slash resolving to a file under the static root through the global static middleware, but the source is internally inconsistent about whether a route or group guard protects the corresponding literal path in that global-mount configuration. This issue is fixed in 4.16.0 and 5.4.0.

Etkilenen sürümler1 yazılım

Kaynaklar7 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…k/echo/security/advisories/GHSA-375p-5qhx-8wq4 Diğer
• github.com/…ommit/b838391e2eade87ae7e5a09d7bb5087bec271ec1 Diğer
• github.com/…ommit/fc410094b2f3415cf2bf5204082137b205bfd5af Diğer
• github.com/labstack/echo/releases/tag/v4.16.0 Diğer
• github.com/labstack/echo/releases/tag/v5.4.0 Diğer

Kayıt geçmişi

1. 28 Eki 2026 22:25Yayımlandı

İlgili açıklar

• 5,3 CVE-2026-118653Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration
• 6,1 CVE-2026-118652Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob
• 5,3 CVE-2026-118651Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default
• 5,3 CVE-2026-118266Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method
• 5,3 CVE-2026-118265Echo: X-Real-IP extractor trusts the header value instead of the sending peer
• 9,1 CVE-2026-118264Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls