CVE-2026-118264

In Echo before 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can be reconstructed before filesystem resolution, reaching a file under a guarded route when static middleware is registered globally.

In Echo before 4.16.0 and 5.4.0, static file handlers can normalize dot segments after route matching and serve a file through a public static route even though the direct path is protected by route-level middleware. This is an incomplete fix for CVE-2026-55677.

In Echo from 4.0.0 until 5.1.0, Context.RealIP falls back to client-supplied X-Forwarded-For or X-Real-IP when Echo.IPExtractor is unset, and the default RateLimiter uses that result as the client identifier. An attacker can rotate forwarded-address values to obtain new rate-limit buckets and bypass IP-based throttling.

In Echo before 4.16.0 and 5.4.0, Context.JSONP and Context.JSONPBlob concatenate an unvalidated callback value into a JavaScript response. A route passing attacker-controlled input as the callback can return executable script syntax, enabling reflected cross-site scripting.

In Echo from 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can thus make upstream services receive a spoofed client address.

In the Echo Go web framework before 4.16.0 and 5.4.0, a globally mounted middleware.Static instance can interpret an encoded request path differently from the router. The router matches the still-encoded path while the static handler uses the decoded URL.Path, potentially exposing files.

In the Echo Go web framework prior to 4.16.0 and 5.4.0, the MethodOverride middleware accepts a safe HTTP method as the override target for a POST request. When MethodOverride is registered before CSRF in the post-routing middleware chain, route selection retains the original state-changing POST handler but the override changes the method before CSRF evaluates it, causing both token validation and Sec-Fetch-Site checks to be skipped. A cross-site exploit requires an authenticated victim and an override value controllable by a browser-submitted request, such as the form getter used by the advisory reproducer; the default X-HTTP-Method-Override header getter is not settable by a cross-site form.

Echo, a Go web framework, from 5.0.0 until 5.4.1 has a vulnerability in ExtractIPFromRealIPHeader that validates the client-supplied X-Real-IP value instead of the direct network peer. A client can supply a loopback or private address and have Context.RealIP return that spoofed identity.

Echo, a Go web framework, from 5.0.0 until 5.4.1 has a vulnerability in BodyDump middleware that can discard a BodyLimit overflow error for an unknown-length request when BodyDump's capture limit is below the BodyLimit threshold. An HTTP/1.1 chunked request can be truncated and processed successfully despite exceeding the configured limit.

Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware can retain a handler, copy goroutines, and network connections after a WebSocket client disconnects when the upstream keeps its connection open. The raw proxy waits for both copy directions without reliably closing the peer connection when one direction ends, including when a rejected upgrade response uses HTTP keep-alive. Repeated connections can accumulate resources and cause denial of service, depending on proxy-route accessibility, upstream behavior, and connection deadlines. This issue is fixed in 4.16.1 and 5.4.1.