Vulnerabilities

TI-2026-27240 CVE-2026-35037 · GHSA-cqgf-f4x7-g6wc

Ech0 affected by unauthenticated SSRF in GetWebsiteTitle allows access to internal services and cloud metadata

HIGH 71

Ech0 is an open-source, self-hosted publishing platform for personal idea sharing.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00618 Published 2026-04-06 Fixed in 4.2.8, 1.4.8-0.20260401031029-4ca56fea5ba4 CWE-918

TI-2026-27239 CVE-2026-35036 · GHSA-wc4h-2348-jc3p

HIGH 72

Ech0 is an open-source, self-hosted publishing platform for personal idea sharing.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00332 Published 2026-04-06 Fixed in 4.2.8, 1.4.8-0.20260401031029-4ca56fea5ba4 CWE-918

TI-2026-26019 CVE-2026-33638 · GHSA-m983-7426-5hrj

MEDIUM 63

Ech0 is an open-source, self-hosted publishing platform for personal idea sharing.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00503 Published 2026-03-26 Fixed in 4.2.0, 1.4.8-0.20260322121226-acbf1fd71011 CWE-862