A globally mounted Echo middleware.Static instance interprets encoded URL paths differently from the framework’s router. While the router continues to match the still‑encoded path, the static handler decodes URL.Path, allowing an encoded slash (%2F) to resolve to a file path under the static root that would otherwise be protected by route or group middleware. The effect is a privilege escalation or data disclosure because an attacker can craft a request that bypasses middleware guards and serves static content from directories that should be inaccessible.

The affected product is Echo, the Go web framework maintained by Labstack. Any installation using a global static middleware in versions earlier than 4.16.0 or 5.4.0 is vulnerable. These versions lack the path‑decoding guard that aligns the router and static handler.

The CVSS score of 7.5 indicates a high severity vulnerability. The attack can be performed remotely by sending an HTTP request containing an encoded slash to a host running Echo. An attacker does not need advanced privileges, only the ability to request the vulnerable static resource. The vulnerability is not listed in the CISA KEV catalog and no EPSS score is available, but the potential impact of unauthorized file exposure makes it a priority. Because the path mismatch is a direct result of how Echo handles URL decoding, the flaw is readily exploitable if the attacker can target a vulnerable deployment.