[GHSA] GHSA-vfp3-v2gw-7wfq (high) — Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files

GHSA-vfp3-v2gw-7wfq Severity: high CVE: CVE-2026-55677

Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files

### Summary

Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path (preserving `%2F` as-is), while `StaticDirectoryHandler` unescapes `%2F` to `/` before resolving filesystem paths. This allow