Most recent entries from all

EUVD-2026-281011

2026-10-13T02:35:40.986961+00:00

EUVD-2026-281011

fkie_cve-2026-35036

2026-10-13T02:35:40.986995+00:00

Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to 4.2.8, Ech0 implements link preview (editor fetches a page title) through GET /api/website/title. That is legitimate product behavior, but the implementation is unsafe: the route is unauthenticated, accepts a fully attacker-controlled URL, performs a server-side GET, reads the entire response body into memory (io.ReadAll). There is no host allowlist, no SSRF filter, and InsecureSkipVerify: true on the outbound client. Anyone who can reach the instance can force the Ech0 server to open HTTP/HTTPS URLs of their choice as seen from the server’s network position (Docker bridge, VPC, localhost from the process view). This vulnerability is fixed in 4.2.8.

GHSA-wc4h-2348-jc3p — Ech0 has Unauthenticated Server-Side Request Forgery in Website Preview Feature

2026-10-13T02:35:40.987033+00:00

Affected: Go: github.com/lin-snow/ech0

### Summary

Ech0 implements **link preview** (editor fetches a page title) through **`GET /api/website/title`**. That is **legitimate product behavior**, but the implementation is **unsafe**: the route is **unauthenticated**, accepts a **fully attacker-controlled URL**, performs a **server-side GET**, reads the **entire response body** into memory (`io.ReadAll`). There is **no** host allowlist, **no** SSRF filter, and **`InsecureSkipVerify: true`** on the outbound client.

**Attacker outcome :** Anyone who can reach the instance can **force the Ech0 server** to open **HTTP/HTTPS URLs of their choice** as seen from the **server’s network position** (Docker bridge, VPC, localhost from the process view). Go’s default `http.Client` **follows redirects** (unless disabled). Redirect chains can move the server-side request from an allowed-looking host to an internal target; the code does not disable this in `SendRequest`.

### Affected Components

**Ech0 codebase:**

- `internal/handler/common/common.go` Handles the `/api/website/title` endpoint and accepts user-controlled URL input.

- `internal/service/common/common.go` Processes the request and invokes the outbound HTTP fetch (`GetWebsiteTitle`).

- `internal/util/http/http.go` Performs the HTTP request (`SendRequest`) with the following insecure configurations: - No URL validation or allowlist - Redirects enabled (default client behavior) - `InsecureSkipVerify: true`

### PoC

**Environment:** Ech0 listenin…