Vulnerability · Published Aug 25, 2026 · Assigned by VulnCheck
CVE-2026-79670Ech0 before 4.4.3 Stored XSS via SVG Upload
Medium 4.8
In plain English
A medium-severity unrestricted file upload in Ech0 from lin-snow. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Ech0 before 4.4.3 contains a stored cross-site scripting vulnerability in the file upload endpoint that validates Content-Type using only client-supplied headers without server-side inspection. Attackers with admin privileges can upload SVG or HTML files containing JavaScript that executes in the application origin when accessed by any user, enabling session hijacking and data exfiltration.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/lin-snow/ech0 | 4.4.3 | GHSA-69hx-63pv-f8f4 |
| Go | github.com/lin-snow/ech0 | no fix listed | GO-2026-5172 |
Affected products (as reported)
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
References
- GitHub Security Advisory (GHSA-69hx-63pv-f8f4) vendor-advisory
- VulnCheck Advisory: Ech0 before 4.4.3 Stored XSS via SVG Upload third-party-advisory