Vendor
An inconsistency between URL path decoding in the Echo framework router and static file handler allows attackers to bypass authentication by using encoded slashes.