CVE-2026-35036

Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to 4.2.8, Ech0 implements link preview (editor fetches a page title) through GET /api/website/title. That is legitimate product behavior, but the implementation is unsafe: the route is unauthenticated, accepts a fully attacker-controlled URL, performs a server-side GET, reads the entire response body into memory (io.ReadAll). There is no host allowlist, no SSRF filter, and InsecureSkipVerify: true on the outbound client. Anyone who can reach the instance can force the Ech0 server to open HTTP/HTTPS URLs of their choice as seen from the server’s network position (Docker bridge, VPC, localhost from the process view). This vulnerability is fixed in 4.2.8.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/lin-snow/Ech0/security/advisories/GHSA-wc4h-2348-jc3p	Exploit Mitigation Vendor Advisory
https://github.com/lin-snow/Ech0/security/advisories/GHSA-wc4h-2348-jc3p	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:ech0:ech0:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-04-06 17:17

Updated : 2026-06-17 10:40

NVD link : CVE-2026-35036

Mitre link : CVE-2026-35036

CVE.ORG link : CVE-2026-35036

JSON object : View

Products Affected

ech0

ech0

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-35036", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35036", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-07T14:09:37.452061Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "lin-snow", "product": "Ech0", "versions": [{"status": "affected", "version": "< 4.2.8"}]}]}], "published": "2026-04-06T17:17:12.940", "references": [{"url": "https://github.com/lin-snow/Ech0/security/advisories/GHSA-wc4h-2348-jc3p", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/lin-snow/Ech0/security/advisories/GHSA-wc4h-2348-jc3p", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to 4.2.8, Ech0 implements link preview (editor fetches a page title) through GET /api/website/title. That is legitimate product behavior, but the implementation is unsafe: the route is unauthenticated, accepts a fully attacker-controlled URL, performs a server-side GET, reads the entire response body into memory (io.ReadAll). There is no host allowlist, no SSRF filter, and InsecureSkipVerify: true on the outbound client. Anyone who can reach the instance can force the Ech0 server to open HTTP/HTTPS URLs of their choice as seen from the server\u2019s network position (Docker bridge, VPC, localhost from the process view). This vulnerability is fixed in 4.2.8."}], "lastModified": "2026-06-17T10:40:00.060", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ech0:ech0:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9571E0F6-6EAF-4AFD-AE06-4E579DFE798A", "versionEndExcluding": "4.2.8"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}