CVE-2026-35037
Description
Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to 4.2.8, the GET /api/website/title endpoint accepts an arbitrary URL via the website_url query parameter and makes a server-side HTTP request to it without any validation of the target host or IP address. The endpoint requires no authentication. An attacker can use this to reach internal network services, cloud metadata endpoints (169.254.169.254), and localhost-bound services, with partial response data exfiltrated via the HTML <title> tag extraction This vulnerability is fixed in 4.2.8.
How to fix
- ech0 ech04.2.8 or later
- github.com/lin-snow/ech01.4.8-0.20260401031029-4ca56fea5ba4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ech0 ech0 | v < 4.2.8 | 4.2.8 |
| github.com/lin-snow/ech0Go | v < 1.4.8-0.20260401031029-4ca56fea5ba4 | 1.4.8-0.20260401031029-4ca56fea5ba4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.