CVE-2026-35036: fallo de gravedad alta en lin-snow Ech0
Ech0 Affected by Unauthenticated Server-Side Request Forgery in Website Preview Feature
Publicada el · Actualizada el
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.5epss 0.3%
probabilidad de explotación
0.3%top 74% de las CVE
explotación observada
noninguna fuente lo reporta
Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to 4.2.8, Ech0 implements link preview (editor fetches a page title) through GET /api/website/title. That is legitimate product behavior, but the implementation is unsafe: the route is unauthenticated, accepts a fully attacker-controlled URL, performs a server-side GET, reads the entire response body into memory (io.ReadAll). There is no host allowlist, no SSRF filter, and InsecureSkipVerify: true on the outbound client. Anyone who can reach the instance can force the Ech0 server to open HTTP/HTTPS URLs of their choice as seen from the server’s network position (Docker bridge, VPC, localhost from the process view). This vulnerability is fixed in 4.2.8.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Productos afectados
lin-snow · Ech0CVEs relacionadas — lin-snow Ech0
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-35037HIGHEch0 affected by unauthenticated SSRF in GetWebsiteTitle allows access to internal services and cloud metadataEPSS 0.6%CVE-2026-79665HIGHEch0 before 4.5.1 Authorization Bypass via Session TokensEPSS 0.5%CVE-2026-79658HIGHEch0 before 5.0.1 Denial of Service via Accept-LanguageEPSS 0.5%CVE-2026-33638MEDIUMEch0 authenticated user-list exposed data via public `/api/allusers` endpointEPSS 0.5%CVE-2026-79668MEDIUMEch0 before 4.7.3 Unauthenticated Like Endpoint Metric InflationEPSS 0.4%CVE-2026-79661MEDIUMEch0 before 4.7.3 Unauthenticated fav_count ModificationEPSS 0.4%