high · 7.5CVE-2026-55677Aug 25, 2026

CVE-2026-55677: Echo v5 Encoded Slash Route-Bypass Exposes Static Files

Rohit Hatagale
AI Security Researcher, SecureLayer7

Sending %2F instead of / in a URL tricks Echo's router into skipping auth middleware while the static file handler still decodes and serves the protected file.

Packagegithub.com/labstack/echo/v5
Ecosystemgo
Affected< 5.2.0
Fixed in5.2.0
CVE-2026-55677: Echo v5 Encoded Slash Route-Bypass Exposes Static Files

The problem

Echo's router and its static file handler process URL encoding differently. The router matches routes against the raw path, so a request like /admin%2Fsecret.txt is treated as a single path segment and never matched against the /admin/* route, meaning any auth middleware on that group is never invoked.

Meanwhile, StaticDirectoryHandler calls url.PathUnescape() on the wildcard param before opening files, converting %2F back to / and serving admin/secret.txt from disk. Any app that guards a route prefix with middleware while serving a broader static root is affected.

Proof of concept

A working proof-of-concept for CVE-2026-55677 in github.com/labstack/echo/v5, with the exact payload below.

http
GET /admin%2Fsecret.txt HTTP/1.1
Host: target.example.com

The root cause is a decoding split: the router consumes req.URL.RawPath (encoded) for matching, but StaticDirectoryHandler calls url.PathUnescape() on the wildcard param before the filesystem open. This lets %2F act as a router-invisible separator that the filesystem resolves normally.

PR #3009 (v5.2.0) added a check that rejects paths containing encoded separators (%2F, %5C) when EnablePathUnescaping is false. PR #3016 then flipped the default so unescaping is opt-in rather than opt-out, making safe behavior the zero-value configuration.

The fix

Upgrade to github.com/labstack/echo/v5 v5.2.0 or later (v4 users: v4.15.3). After upgrading, path unescaping is disabled by default. Do not set EnablePathUnescaping: true unless your filenames literally contain encoded characters and you are not relying on route-based ACLs.

As a defense-in-depth measure, attach auth middleware directly to the static mount instead of relying on sibling route guards.

Reported by a-tt-om and oran-gugu.

References: [1][2][3][4][5][6]

Related research