{"id":"CVE-2026-35036","aliases":["GHSA-wc4h-2348-jc3p","GO-2026-5704"],"url":"https://o3.security/vulnerability/CVE-2026-35036","summary":"Ech0 Affected by Unauthenticated Server-Side Request Forgery in Website Preview Feature","details":"Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to 4.2.8, Ech0 implements link preview (editor fetches a page title) through GET /api/website/title. That is legitimate product behavior, but the implementation is unsafe: the route is unauthenticated, accepts a fully attacker-controlled URL, performs a server-side GET, reads the entire response body into memory (io.ReadAll). There is no host allowlist, no SSRF filter, and InsecureSkipVerify: true on the outbound client. Anyone who can reach the instance can force the Ech0 server to open HTTP/HTTPS URLs of their choice as seen from the server’s network position (Docker bridge, VPC, localhost from the process view). This vulnerability is fixed in 4.2.8.","published":"2026-04-06T16:55:47.544Z","modified":"2026-07-31T18:31:41.485645694Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/lin-snow/ech0","fixedVersion":"1.4.8-0.20260401031029-4ca56fea5ba4"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35036.json"},{"type":"ADVISORY","url":"https://github.com/lin-snow/Ech0/security/advisories/GHSA-wc4h-2348-jc3p"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35036"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-31T18:31:41.485645694Z"}}