echo v5.2.1

{
  "id": "3fb05192dfb63b6bce5a8c7fcbe60d4f4cc2f32ea23b6f6e010d26eac7506a2f",
  "url": "https://github.com/labstack/echo/releases/tag/v5.2.1",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "echo v5.2.1",
    "summary": "The release makes path unescaping opt-in for static file serving, preventing encoded separators from being decoded before routing or file lookup by default. It warns that static mounts expose their entire subtree and recommends authorization middleware directly on the mount.",
    "evidence": "Path unescaping is now opt-in. What this protects: With EnablePathUnescaping: false (new default), encoded separators (%2F, %5C) are never decoded before routing or file lookup, so they cannot bypass route-level authentication or other middleware guards.",
    "products": [
      {
        "name": {
          "value": "echo",
          "evidence": "Release notes from echo"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "v5.2.1",
            "evidence": "v5.2.1"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "github-labstack-echo",
  "document_id": 21593,
  "published_at": "2026-06-15T17:12:57+00:00"
}