Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path (preserving %2F as-is), while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an attacker to bypass route-level access controls and read static files without authorization. This vulnerability is fixed in 4.15.3 and 5.2.0.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade osbuild-composer-coreUpgrade osbuild-composer-workerUpgrade osbuild-composer | Oct 11, 2026 | Sep 14, 2026 |
| Redhat_linux | — | Upgrade osbuild-composer-workerUpgrade osbuild-composerUpgrade osbuild-composer-dnf-jsonUpgrade osbuild-composer-worker-debuginfoUpgrade osbuild-composer-tests-debuginfoUpgrade osbuild-composer-debugsourceUpgrade osbuild-composer-core-debuginfoUpgrade osbuild-composer-coreUpgrade osbuild-composer-debuginfo | Jul 24, 2026 | Jun 26, 2026 |
| Rocky_linux | — | Upgrade osbuild-composer-core-debuginfoUpgrade osbuild-composer-debuginfoUpgrade osbuild-composer-coreUpgrade osbuild-composer-debugsourceUpgrade osbuild-composer-workerUpgrade osbuild-composerUpgrade osbuild-composer-worker-debuginfo | Sep 15, 2026 | Sep 11, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub