Description
Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently be reconstructed before filesystem resolution. This can reach a file under a guarded route when the static middleware is registered globally. This issue is fixed in 4.15.3 and 5.2.0.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
labstack echo
>= 5.0.0, < 5.2.0affected< 4.15.3affected
References
- https://github.com/labstack/echo/security/advisories/GHSA-xwq5-6cqp-vx96 ↗
- https://github.com/labstack/echo/issues/2599 ↗
- https://github.com/labstack/echo/pull/3006 ↗
- https://github.com/labstack/echo/commit/a9ede66a5a7196411131beb1ee801e75bbaf7ac6 ↗
- https://github.com/labstack/echo/commit/c3fa2a27ff92b2b8db360de614f999ef1da24725 ↗
- https://github.com/labstack/echo/releases/tag/v4.15.3 ↗
- https://github.com/labstack/echo/releases/tag/v5.2.0 ↗