CVE-2026-35037 json
Ech0 affected by unauthenticated SSRF in GetWebsiteTitle allows access to internal services and cloud metadata
published 2026-04-03 7 mo ago modified 2026-10-24 16 d ago also EUVD-2026-19378 , GHSA-cqgf-f4x7-g6wc , GO-2026-5331
- cvss
- 7.2
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 49%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to 4.2.8, the GET /api/website/title endpoint accepts an arbitrary URL via the website_url query parameter and makes a server-side HTTP request to it without any validation of the target host or IP address. The endpoint requires no authentication. An attacker can use this to reach internal network services, cloud metadata endpoints (169.254.169.254), and localhost-bound services, with partial response data exfiltrated via the HTML <title> tag extraction This vulnerability is fixed in 4.2.8.
Patch / fix
- go github.com/lin-snow/ech0 1.4.8-0.20260401031029-4ca56fea5ba4
- ech0 ech0 4.2.8
- govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
opensuse advisories openSUSE-SU-2026:21483-1
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 7 mo ago
Exploit prediction
0.62% chance of exploitation in the next 30 days, higher than 49% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Nuclei template Ech0 < 4.2.8 - Server-Side Request Forgery nuclei detection template
- github.com https://github.com/lin-snow/Ech0/security/advisories/GHSA-cqgf-f4x7-g6wc referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 7.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/lin-snow/ech0 | <1.4.8-0.20260401031029-4ca56fea5ba4 |
1.4.8-0.20260401031029-4ca56fea5ba4 |
Affected products
- lin-snow Ech0
Classification
- Weakness
-
- CWE-918 Server-Side Request Forgery
References
-
github.com
/lin-snow/Ech0/security/advisories/GHSA-cqgf-f4x7-g6wc
web, exploit, mitigation, vendor-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-35037
advisory
-
github.com
/lin-snow/Ech0
package
Sources
- CVE List CVE-2026-35037
- GitHub Advisory GHSA-cqgf-f4x7-g6wc
- NVD CVE-2026-35037
- OSV GO-2026-5331
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.