Echo's static file handlers normalize dot segments after a request has matched a route. Prior to versions 4.16.0 and 5.4.0, this normalization could transform a URI that points to a protected resource into a path that resolves to a file located under a public static directory. The attacker can then read any file that the application had intended to protect with route‑level middleware. The vulnerability is a path‑traversal flaw, CWE‑22, that results in confidential data disclosure but does not give the attacker code execution or privilege escalation.

The bug affects the Go web framework Echo from the labstack vendor. Any installation of Echo version 4.15.x or earlier, and 5.3.x or earlier, is vulnerable. The issue was fixed in Echo release 4.16.0 and 5.4.0. Systems running earlier releases without applying the patch are at risk.

The CVSS score of 5.9 indicates a moderate risk. Because the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the exploitation likelihood cannot be precisely quantified, but the flaw can be triggered with a simple HTTP GET request that contains encoded dot‑dot segments. Authentication is not required and the attacker only needs to know a protected file name and that a public static mount exists. The impact is limited to unauthorized file disclosure and is mitigated by the vendor’s patches.