Labstack Echo CVE-2026-118658

Exploitation requires three concrete conditions, all stated in the advisory: (1) the application must use Echo's WWWRedirect() or NonWWWRedirect() middleware (including their WithConfig variants) - the HTTPSRedirect, HTTPSWWWRedirect, and HTTPSNonWWWRedirect variants hardcode https:// and are NOT affected; (2) the deployment must allow the attacker-controlled X-Forwarded-Proto, X-Forwarded-Protocol, or X-Url-Scheme header to reach the app, i.e. there is no edge proxy that overwrites or strips these headers; and (3) per CVSS UI:R, a victim must act on the manipulated redirect response for impact to materialize. Confirmed injectable schemes include javascript, data, vbscript, file, ftp, ssh, telnet, and gopher. These limiting factors (specific middleware, proxy header handling, and required user interaction) substantially narrow realistic exposure below what AV:N alone suggests.

This is a genuinely low-to-moderate priority issue despite the network attack vector, and the signals are internally consistent rather than conflicting. The CVSS 3.1 base score is 4.7 (Medium), driven down by AC:H and UI:R: the vector is AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N, meaning no authentication is required (PR:N) but exploitation depends on conditions outside the attacker's sole control and on a victim acting on the manipulated redirect response. The vuln.today decision label is 'this_month', signaling a scheduled-remediation rather than emergency posture. No EPSS probability, no CISA KEV listing, and no SSVC automatable/technical-impact breakdown were supplied, so widespread or automated exploitation cannot be inferred - absence of these is not evidence of safety, only of unmeasured likelihood. A concrete proof-of-concept (a crafted GET with X-Forwarded-Proto: javascript yielding Location: javascript://www.example.com/path) is published in the GHSA advisory and was manually verified against a live server by the reporter, so the mechanism is real and demonstrated, but this is CWE-601 open redirect, not direct code execution on the server. Real risk is bounded by the limiting conditions below (specific middleware in use, app not behind a header-stripping proxy, and a user following the redirect), which is why this is a 'patch on normal cadence' item, not a drop-everything one.

An attacker sends a request to an Echo app that uses the WWWRedirect or NonWWWRedirect middleware and is deployed where the X-Forwarded-Proto header is not stripped by an edge proxy, setting that header to an attacker-chosen scheme such as javascript, data, or file. Echo's Context.Scheme() returns the value verbatim and the middleware builds a Location header like 'javascript://www.example.com/path'. A public PoC demonstrating this is published in the GHSA advisory; actual harm (e.g. script execution, cache poisoning behind a caching CDN) requires a victim's browser to act on the returned redirect, consistent with the AC:H/UI:R metrics.