CVE-2026-35037 Details
Description
Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to 4.2.8, the GET /api/website/title endpoint accepts an arbitrary URL via the website_url query parameter and makes a server-side HTTP request to it without any validation of the target host or IP address. The endpoint requires no authentication. An attacker can use this to reach internal network services, cloud metadata endpoints (169.254.169.254), and localhost-bound services, with partial response data exfiltrated via the HTML <title> tag extraction This vulnerability is fixed in 4.2.8.
A server-side request forgery (SSRF) vulnerability has been identified in Ech0, an open-source publishing platform, in versions prior to 4.2.8. The vulnerability exists in the GET /api/website/title endpoint, which accepts an arbitrary URL through the website_url query parameter. This endpoint makes an HTTP request to the specified URL without validating the target host or IP address, and it requires no authentication. As a result, an attacker can access internal network services, cloud metadata endpoints (such as AWS metadata service), and services bound to localhost. The vulnerability also allows for partial response data to be exfiltrated via the HTML title tag extraction.
Users are advised to update to Ech0 version 4.2.8 or later, and to implement URL validation in the GetWebsiteTitle function to block requests to private or reserved IP ranges.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/lin-snow/Ech0/security/advisories/GHSA-cqgf-f4x7-g6wc | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ech0 ech0 | < 4.2.8 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 22, 2026 | Initial Analysis | [email protected] |
| Apr 6, 2026 | New CVE Received | [email protected] |