Read the docs
TI-2026-27239 Aliases CVE-2026-35036GHSA-wc4h-2348-jc3p

Ech0 Affected by Unauthenticated Server-Side Request Forgery in Website Preview Feature

Priority HIGH 72CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-918 and the CVSS impact.

Summary

Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to 4.2.8, Ech0 implements link preview (editor fetches a page title) through GET /api/website/title. That is legitimate product behavior, but the implementation is unsafe: the route is unauthenticated, accepts a fully attacker-controlled URL, performs a server-side GET, reads the entire response body into memory (io.ReadAll). There is no host allowlist, no SSRF filter, and InsecureSkipVerify: true on the outbound client. Anyone who can reach the instance can force the Ech0 server to open HTTP/HTTPS URLs of their choice as seen from the server’s network position (Docker bridge, VPC, localhost from the process view). This vulnerability is fixed in 4.2.8.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00332 26th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Ech0 (lin-snow): 4.2.8github.com/lin-snow/ech0 (Go): 1.4.8-0.20260401031029-4ca56fea5ba4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
lin-snowEch0before 4.2.84.2.8Patch availableCNA
—github.com/lin-snow/ech0 (Go)before 1.4.8-0.20260401031029-4ca56fea5ba41.4.8-0.20260401031029-4ca56fea5ba4Patch availableGHSA-wc4h-2348-jc3p
  • Ech0 Vendorlin-snow Affected before 4.2.8 Fixed in 4.2.8 Patch available CNA
  • github.com/lin-snow/ech0 (Go) Vendor— Affected before 1.4.8-0.20260401031029-4ca56fea5ba4 Fixed in 1.4.8-0.20260401031029-4ca56fea5ba4 Patch available GHSA-wc4h-2348-jc3p

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ech0:ech0:*:*:*:*:*:*:*:*before 4.2.8Vulnerablelin-snow
  • cpe:2.3:a:ech0:ech0:*:*:*:*:*:*:*:* Versions before 4.2.8 Vulnerable ·lin-snow

Remediation

  • Fix · CNA Ech0 (lin-snow) Fixed in 4.2.8
  • Fix · GHSA-wc4h-2348-jc3p github.com/lin-snow/ech0 (Go) Fixed in 1.4.8-0.20260401031029-4ca56fea5ba4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-35036
  2. 2026-10-03 Alias added: GHSA-wc4h-2348-jc3p

References

Exploit 1

Advisory 1

Other 1

  • TI-2026-27240 Ech0 affected by unauthenticated SSRF in GetWebsiteTitle allows access to internal services and cloud metadata CVSS 3.1HIGH 7.2
  • TI-2026-26019 Ech0 authenticated user-list exposed data via public `/api/allusers` endpoint CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences