Echo Web Framework CVE-2026-118266

Exploitation requires a specific non-default deployment: MethodOverride middleware must be registered via e.Use() (post-routing) BEFORE the CSRF middleware in the chain, AND configured with a browser-settable getter such as MethodFromForm('_method') or MethodFromQuery - these are the getters a cross-site HTML form or URL can control. It also requires an authenticated victim with an active session who visits an attacker-controlled page (classic CSRF user interaction). Key limiting factors: the DEFAULT X-HTTP-Method-Override header getter is NOT exploitable cross-site because a cross-site form cannot set request headers; registering MethodOverride with e.Pre() (the documented placement) or registering CSRF before MethodOverride also closes the bypass; and only POST requests are overrideable. Thus applications using Echo's defaults are not affected - the vulnerable form/query-getter-before-CSRF ordering must be explicitly configured.

This is a genuine but conditional, medium-severity CSRF-protection bypass (CWE-352) - not a drop-everything emergency. The CVSS signals are mildly conflicting: the input base score is 5.3 with vector AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N, while the vendor GHSA advisory rates it 5.1 with AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N - they disagree on Attack Complexity (H vs L) and Confidentiality (N vs L) but agree on the core: network vector, no attacker privileges, user interaction required, high integrity impact, no availability impact. No EPSS score was supplied and the CVE is not on the CISA KEV list, so there is no evidence of widespread or active exploitation. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a real-but-paced fix priority. Crucially, exploitability hinges on a non-default and arguably misconfigured middleware setup (MethodOverride registered before CSRF via e.Use() with a browser-settable getter), which materially lowers real-world reach below what the network vector alone implies. Bottom line: prioritize patching this month for teams running the vulnerable configuration; it is a legitimate integrity risk but closer to a targeted/conditional issue than a mass-exploitable one.

An attacker hosts a web page that auto-submits a cross-site POST form to a state-changing endpoint (e.g. /transfer) on a vulnerable Echo application, including a form field such as _method=GET. When an authenticated victim visits the page, Echo routes the request to the original POST handler, MethodOverride rewrites the method to GET before CSRF runs, and both the CSRF token check and the Sec-Fetch-Site check are skipped, so the state-changing action executes. The GHSA advisory includes a working reproducer (curl commands and a browser auto-submit form), demonstrating the bypass; attack complexity is low once the vulnerable ordering/getter is deployed, but it still requires the victim to be authenticated and to load the attacker page.