Multiple security vulnerabilities have been identified in the Echo web framework, affecting its static file middleware and redirect handling components. These flaws allow attackers to bypass route protections, inject arbitrary schemes, and perform open redirects, posing significant risks to application integrity and user security. The affected versions include specific releases of the framework where these logic errors in path sanitization and header validation were present.
CVE-2026-118658 (CVSS 4.7 — Medium): This vulnerability allows arbitrary scheme injection in the WWWRedirect and NonWWWRedirect middlewares by trusting the X-Forwarded-Proto header without validation. An attacker can inject schemes such as javascript or file into the Location response header, potentially leading to open redirects or cache poisoning when the application is not behind a proxy that strips these headers.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in the Echo web framework, affecting its static file middleware and redirect handling components. These flaws allow attackers to bypass route protections, inject arbitrary schemes, and perform open redirects, posing significant risks to application integrity and user security. The affected versions include specific releases of the framework where these logic errors in path sanitization and header validation were present.
CVE-2026-118658 (CVSS 4.7 — Medium): This vulnerability allows arbitrary scheme injection in the WWWRedirect and NonWWWRedirect middlewares by trusting the X-Forwarded-Proto header without validation. An attacker can inject schemes such as javascript or file into the Location response header, potentially leading to open redirects or cache poisoning when the application is not behind a proxy that strips these headers.[emaillocker id="1283"]
CVE-2026-118656 (CVSS 6.1 — Medium): An open redirect vulnerability exists in the sanitizeURI function, which fails to detect control characters at the beginning of the URI. By prefixing a path with a tab character, an attacker can bypass the guard that checks for double slashes, causing the browser to resolve the redirect to an external attacker-controlled domain.
CVE-2026-118655 (CVSS 5.9 — Medium): The static middleware contains a double-unescape path traversal flaw where it unescapes an already decoded URL path. This allows percent-encoded traversal sequences to reach files outside the intended directory, potentially exposing sensitive data when the middleware is registered globally.
CVE-2026-118654 (CVSS 5.9 — Medium): A route protection bypass in the static file middleware allows encoded dot-dot traversal to access protected files. By using encoded dot-dot segments, an attacker can bypass middleware that blocks direct access to certain routes, resulting in the disclosure of files that should have been inaccessible.
CVE-2026-118657 (CVSS 5.9 — Medium): This vulnerability involves the bypass of HTTPS redirect and HSTS enforcement through the unconditional trust of forwarded scheme headers. An attacker can manipulate these headers to force the application to issue insecure redirects or disable HSTS, undermining the security guarantees of the transport layer.
These vulnerabilities collectively present a significant risk to applications relying on the Echo framework for secure routing and file serving. Users are most at risk when deploying applications that expose static files or rely on automatic redirect mechanisms without additional proxy-level protections. Immediate attention is required to mitigate the potential for data exposure and unauthorized access.
The following reports contain further technical details:
[/emaillocker]