The vulnerability arises from a mismatch in how the Echo framework's router and static file handler decode URL paths. Routes are matched using the raw encoded path, leaving %2F in place, while the static directory handler unescapes %2F to a forward slash before resolving file system paths. This mismatch allows an attacker to request a URL containing an encoded slash, causing the router to treat the request as a valid route while the static handler interprets it as a file path. The result is that protected routes can be bypassed and arbitrary static files become readable, compromising confidentiality. The weakness is a CWE‑22 Path Traversal flaw.

This issue impacts the Go web framework labstack:echo in all releases prior to 4.15.3 and 5.2.0. Any deployment using those earlier versions is susceptible, including both stable and preview releases.

With a CVSS score of 7.5 the vulnerability is considered high in severity. EPSS data is unavailable, and the vulnerability is not currently listed in CISA's KEV catalog. Attackers can exploit the flaw over a network by crafting an HTTP request that includes an encoded slash in the URL. No local privilege escalation or complex prerequisites are required; the attack is feasible from any external source that can reach the application.