https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 14 Oct 2026 15:27:12 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-281011 EUVD-2026-281011 https://cve.radiocsirt.org/vuln/euvd-2026-281011 https://cve.radiocsirt.org/vuln/fkie_cve-2026-35036 <p>Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to 4.2.8, Ech0 implements link preview (editor fetches a page title) through GET /api/website/title. That is legitimate product behavior, but the implementation is unsafe: the route is unauthenticated, accepts a fully attacker-controlled URL, performs a server-side GET, reads the entire response body into memory (io.ReadAll). There is no host allowlist, no SSRF filter, and InsecureSkipVerify: true on the outbound client. Anyone who can reach the instance can force the Ech0 server to open HTTP/HTTPS URLs of their choice as seen from the server’s network position (Docker bridge, VPC, localhost from the process view). This vulnerability is fixed in 4.2.8.</p> <p>Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to 4.2.8, Ech0 implements link preview (editor fetches a page title) through GET /api/website/title. That is legitimate product behavior, but the implementation is unsafe: the route is unauthenticated, accepts a fully attacker-controlled URL, performs a server-side GET, reads the entire response body into memory (io.ReadAll). There is no host allowlist, no SSRF filter, and InsecureSkipVerify: true on the outbound client. Anyone who can reach the instance can force the Ech0 server to open HTTP/HTTPS URLs of their choice as seen from the server’s network position (Docker bridge, VPC, localhost from the process view). This vulnerability is fixed in 4.2.8.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-35036 https://cve.radiocsirt.org/vuln/ghsa-wc4h-2348-jc3p <p><strong>Affected:</strong> Go: github.com/lin-snow/ech0</p> <p>### Summary</p> <p>Ech0 implements **link preview** (editor fetches a page title) through **`GET /api/website/title`**. That is **legitimate product behavior**, but the implementation is **unsafe**: the route is **unauthenticated**, accepts a **fully attacker-controlled URL**, performs a **server-side GET**, reads the **entire response body** into memory (`io.ReadAll`). There is **no** host allowlist, **no** SSRF filter, and **`InsecureSkipVerify: true`** on the outbound client.</p> <p>**Attacker outcome :** Anyone who can reach the instance can **force the Ech0 server** to open **HTTP/HTTPS URLs of their choice** as seen from the **server’s network position** (Docker bridge, VPC, localhost from the process view). Go’s default `http.Client` **follows redirects** (unless disabled). Redirect chains can move the server-side request from an allowed-looking host to an internal target; the code does not disable this in `SendRequest`.</p> <p>### Affected Components</p> <p>**Ech0 codebase:**</p> <p>- `internal/handler/common/common.go` Handles the `/api/website/title` endpoint and accepts user-controlled URL input.</p> <p>- `internal/service/common/common.go` Processes the request and invokes the outbound HTTP fetch (`GetWebsiteTitle`).</p> <p>- `internal/util/http/http.go` Performs the HTTP request (`SendRequest`) with the following insecure configurations: - No URL validation or allowlist - Redirects enabled (default client behavior) - `InsecureSkipVerify: true`</p> <p>### PoC</p> <p>**Environment:** Ech0 listenin…</p> <p><strong>Affected:</strong> Go: github.com/lin-snow/ech0</p> <p>### Summary</p> <p>Ech0 implements **link preview** (editor fetches a page title) through **`GET /api/website/title`**. That is **legitimate product behavior**, but the implementation is **unsafe**: the route is **unauthenticated**, accepts a **fully attacker-controlled URL**, performs a **server-side GET**, reads the **entire response body** into memory (`io.ReadAll`). There is **no** host allowlist, **no** SSRF filter, and **`InsecureSkipVerify: true`** on the outbound client.</p> <p>**Attacker outcome :** Anyone who can reach the instance can **force the Ech0 server** to open **HTTP/HTTPS URLs of their choice** as seen from the **server’s network position** (Docker bridge, VPC, localhost from the process view). Go’s default `http.Client` **follows redirects** (unless disabled). Redirect chains can move the server-side request from an allowed-looking host to an internal target; the code does not disable this in `SendRequest`.</p> <p>### Affected Components</p> <p>**Ech0 codebase:**</p> <p>- `internal/handler/common/common.go` Handles the `/api/website/title` endpoint and accepts user-controlled URL input.</p> <p>- `internal/service/common/common.go` Processes the request and invokes the outbound HTTP fetch (`GetWebsiteTitle`).</p> <p>- `internal/util/http/http.go` Performs the HTTP request (`SendRequest`) with the following insecure configurations: - No URL validation or allowlist - Redirects enabled (default client behavior) - `InsecureSkipVerify: true`</p> <p>### PoC</p> <p>**Environment:** Ech0 listenin…</p> https://cve.radiocsirt.org/vuln/ghsa-wc4h-2348-jc3p