CVE-2026-118656— Echo: Open Redirect via Control-Character Prefix Defeating sanitizeURI
Quick assessment
Affected
labstack echo
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Echo 是一个 Go 语言编写的 Web 框架。在 4.16.0 和 5.4.0 版本之前， 函数在判断重定向目标是否以绝对路径分隔符对开头时，仅检查其前两个字节。当 或 配置为使用重定向状态码时，攻击者可构造包含斜杠、制表符（TAB）和路径分隔符的特定路径形式，从而绕过防护机制；该路径会被写入 响应头，并被浏览器解析为攻击者可控的主机地址。此问题已在 4.16.0 和 5.4.0 版本中修复。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-118656
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Echo: Open Redirect via Control-Character Prefix Defeating sanitizeURI
Source: CVE Program / CVE List V5
Vulnerability Description
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI checks only the first two bytes of a redirect target before deciding whether it begins with an absolute-path separator pair. When AddTrailingSlash or RemoveTrailingSlash is configured with a redirect status, a slash, TAB, separator path form can evade the guard, be emitted in the Location header, and be normalized by a browser into an attacker-controlled host. This issue is fixed in 4.16.0 and 5.4.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
指向未可信站点的URL重定向(开放重定向)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-118656
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-118656
请登录查看更多情报信息。
Other References for CVE-2026-118656 (5)
-
https://github.com/labstack/echo/releases/tag/v5.4.0 x_refsource_MISC
-
https://github.com/labstack/echo/releases/tag/v4.16.0 x_refsource_MISC
-
https://github.com/labstack/echo/security/advisories/GHSA-v753-g4cw-jm48 x_refsource_CONFIRM
Same Patch Batch · labstack · 2026-10-28 · 16 CVEs total
| CVE-2026-118264 | 9.1 CRITICAL | Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls |
| CVE-2026-118260 | 8.2 HIGH | Echo: BodyDump captures request and response bodies without size limits in v4 |
| CVE-2026-118262 | 8.2 HIGH | Echo: WebSocket proxy can retain connections and handlers after client disconnect |
| CVE-2026-118261 | 8.2 HIGH | Echo: Decompress permits unbounded gzip expansion in v4 |
| CVE-2026-118650 | 7.5 HIGH | Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a sta |
| CVE-2026-118263 | 6.3 MEDIUM | Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests |
| CVE-2026-118652 | 6.1 MEDIUM | Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP |
| CVE-2026-118654 | 5.9 MEDIUM | Echo static file middleware route protection bypass via encoded dot-dot traversal |
| CVE-2026-118655 | 5.9 MEDIUM | Echo: Static Middleware Double-Unescape Path Traversal |
| CVE-2026-118657 | 5.9 MEDIUM | Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers |
| CVE-2026-118651 | 5.3 MEDIUM | Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default |
| CVE-2026-118266 | 5.3 MEDIUM | Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method |
| CVE-2026-118265 | 5.3 MEDIUM | Echo: X-Real-IP extractor trusts the header value instead of the sending peer |
| CVE-2026-118653 | 5.3 MEDIUM | Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration |
| CVE-2026-118658 | 4.7 MEDIUM | Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded |
IV. Related Vulnerabilities
Same product: echo
-
CVE-2026-118658
Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedire -
CVE-2026-118657
Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust -
CVE-2026-118655
Echo: Static Middleware Double-Unescape Path Traversal -
CVE-2026-118654
Echo static file middleware route protection bypass via enco -
CVE-2026-118653
Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header
Same vendor: labstack
-
CVE-2026-118658
Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedire -
CVE-2026-118657
Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust -
CVE-2026-118655
Echo: Static Middleware Double-Unescape Path Traversal -
CVE-2026-118654
Echo static file middleware route protection bypass via enco -
CVE-2026-118653
Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header
Same weakness: CWE-601
-
CVE-2026-118658
Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedire -
CVE-2026-117553
Umbraco CMS before 17.7.2 and 18.2.2 Account Takeover via Ho -
CVE-2026-116578
Tornado: Open redirect in RedirectHandler via protocol-relat -
CVE-2026-81509
nforwardauth: Unvalidated r parameter allows post-authentica -
CVE-2026-115196
Mautic 所有版本公开表单提交端点存在开放重定向漏洞