GHSA-xwq5-6cqp-vx96 Echo has a Static Middleware Double-Unescape Path Traversal

• Go github.com/labstack/echo/v5: < 5.2.0 → fixed in 5.2.0 • Go github.com/labstack/echo/v4: < 4.15.3 → fixed in 4.15.3

Summary Commit a9ede66a (PR #3006, issue #2599) silently fixed a path traversal vulnerability in the Echo web framework's static file middleware. Vulnerability The static middleware double-unescaped URL paths. Go's net/http already decodes Request.URL.Path, but middleware/static.go unconditionally called url.PathUnescape() again: ```go // BEFORE (vulnerable) pathUnescape := true ``` This reassembled path traversal sequences from double-encoded input. An attacker could send GET /%2e%2e%2fsecret.txt or /..%252fsecret.txt and the double-unescape would produce ../secret.txt. Fix ```go // AFTER (fixed) pathUnescape := false ``` The commit's test TestStatic_percentEncodedTraversalIsBlocked explicitly verifies traversal vectors are blocked. Impact Arbitrary file read from server filesystem via percent-encoded path traversal. References • Fix: https://github.com/labstack/echo/commit/a9ede66a • Issue: https://github.com/labstack/echo/issues/2599 • PR: https://github.com/labstack/echo/pull/3006 Patches Fixed in `github.com/labstack/echo/v5` v5.2.0 and `github.com/labstack/echo/v4` v4.15.3, where the Static middleware stopped unescaping an already decoded path. Maintainer analysis: reading files outside the configured root could not be reproduced; the confirmed impact was that a double-encoded slash (`%252F`) could reach a file under a guarded route when the Static middleware is registered globally. Upgrade to v5.4.0 / v4.16.0 or later, which also includes related fixes for encoded and dot-segment paths. Workarounds Keep files that need protection outside the Static middleware's root directory.