Описание
Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path (preserving %2F as-is), while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an attacker to bypass route-level access controls and read static files without authorization. This vulnerability is fixed in 4.15.3 and 5.2.0.
A flaw was found in Echo, a Go web framework. An attacker can exploit a disagreement in URL path decoding between the router and the static file handler. The router processes raw encoded paths, while the static file handler unescapes encoded forward slashes. This allows an attacker to bypass route-level access controls, leading to unauthorized information disclosure by reading static files.
Отчет
This is an Important information disclosure flaw in the Echo web framework. The discrepancy in URL path decoding between the router and static file handler allows an unauthenticated attacker to bypass access controls and read arbitrary static files. This could lead to the exposure of sensitive data hosted on affected Red Hat products utilizing the Echo framework for serving static content.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/acm-grafana-rhel9 | Not affected | ||
| Red Hat Ceph Storage 5 | rhceph/rhceph-5-dashboard-rhel8 | Fix deferred | ||
| Red Hat Enterprise Linux 10 | grafana | Not affected | ||
| Red Hat Enterprise Linux 8 | grafana | Not affected | ||
| Red Hat Enterprise Linux 9 | grafana | Not affected | ||
| Red Hat Enterprise Linux 9 | osbuild-composer | Affected | ||
| Red Hat OpenShift Virtualization 4 | container-native-virtualization/hyperconverged-cluster-operator-rhel9 | Not affected | ||
| Red Hat OpenShift Virtualization 4 | container-native-virtualization/hyperconverged-cluster-webhook-rhel9 | Not affected | ||
| Red Hat Enterprise Linux 10 | osbuild-composer | Fixed | RHSA-2026:66432 | 11.09.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | osbuild-composer | Fixed | RHSA-2026:63134 | 03.09.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path (preserving %2F as-is), while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an attacker to bypass route-level access controls and read static files without authorization. This vulnerability is fixed in 4.15.3 and 5.2.0.
Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path (preserving %2F as-is), while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an attacker to bypass route-level access controls and read static files without authorization. This vulnerability is fixed in 4.15.3 and 5.2.0.
Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router a ...
Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files
EPSS
7.5 High
CVSS3