CVE-2026-35036

Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to 4.2.8, Ech0 implements link preview (editor fetches a page title) through GET /api/website/title. That is legitimate product behavior, but the implementation is unsafe: the route is unauthenticated, accepts a fully attacker-controlled URL, performs a server-side GET, reads the entire response body into memory (io.ReadAll). There is no host allowlist, no SSRF filter, and InsecureSkipVerify: true on the outbound client. Anyone who can reach the instance can force the Ech0 server to open HTTP/HTTPS URLs of their choice as seen from the server’s network position (Docker bridge, VPC, localhost from the process view). This vulnerability is fixed in 4.2.8.

• CWE-918

• https://github.com/lin-snow/Ech0/security/advisories/GHSA-wc4h-2348-jc3pExploit, Mitigation, Vendor Advisory
• https://github.com/lin-snow/Ech0/security/advisories/GHSA-wc4h-2348-jc3pExploit, Mitigation, Vendor Advisory

Published

Apr 6, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-35030LiteLLM is a proxy server (AI Gateway) to call LLM APIs in O…9.4
• CVE-2026-35031Jellyfin is an open source self hosted media server. Version…8.8
• CVE-2026-35032Jellyfin is an open source self hosted media server. Version…8.1
• CVE-2026-35033Jellyfin is an open source self hosted media server. Version…9.1
• CVE-2026-35034Jellyfin is an open source self hosted media server. Version…6.5
• CVE-2026-35035CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a …9
• CVE-2026-35037Ech0 is an open-source, self-hosted publishing platform for …7.2
• CVE-2026-35038Signal K Server is a server application that runs on a centr…6.5
• CVE-2026-35039fast-jwt provides fast JSON Web Token (JWT) implementation. …9.1
• CVE-2026-3504The Dokan: AI Powered WooCommerce Multivendor Marketplace So…5.3
• CVE-2026-35040fast-jwt provides fast JSON Web Token (JWT) implementation. …5.3
• CVE-2026-35041fast-jwt provides fast JSON Web Token (JWT) implementation. …6.5