CVE-2026-118650

{
  "etk_id": "ETK-2026-2900",
  "cve_id": "CVE-2026-118650",
  "display_id": "CVE-2026-118650",
  "ghsa_id": "GHSA-375p-5qhx-8wq4",
  "euvd_id": "EUVD-2026-112404",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Encoded-path authorization inconsistency in labstack Echo Static middleware",
  "summary": "Before 5.4.0 in Echo v5 and 4.16.0 in Echo v4, globally mounted Static middleware can interpret encoded request paths differently from the router. An unauthenticated requester may retrieve files within the static root contrary to route- or group-level access-control expectations when an application stores protected files there and relies on those guards.",
  "mitigation": "Upgrade Echo v5 to 5.4.0 or later, or Echo v4 to 4.16.0 or later. Keep protected files outside the global Static middleware root and serve them through handlers protected by the required guard.",
  "vendor": "labstack",
  "product": "echo",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 5.4.0"
      ],
      "ecosystem": "go",
      "fixed_versions": [
        "5.4.0"
      ],
      "package_name": "github.com/labstack/echo/v5",
      "purl": "pkg:golang/github.com/labstack/echo/v5"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 4.16.0"
      ],
      "ecosystem": "go",
      "fixed_versions": [
        "4.16.0"
      ],
      "package_name": "github.com/labstack/echo/v4",
      "purl": "pkg:golang/github.com/labstack/echo/v4"
    }
  ],
  "cwes": [
    177
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 9.937387316666667,
  "t0_at": "2026-10-28T19:25:02.952000+00:00",
  "signals": {
    "public_poc": {
      "at": "2026-10-28T19:54:20+00:00",
      "days": 0.020336203703703704,
      "is_lower_bound": false,
      "measured_at": "2026-10-28T19:25:02.952000+00:00",
      "url": "https://github.com/advisories/GHSA-375p-5qhx-8wq4"
    },
    "trigger_signal": {
      "at": "2026-10-28T19:25:02.952000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-28T19:25:02.952000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-118650"
    }
  }
}