EUVD-2026-65444
GHSA-mj42-9vh2-f8v3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Admin credentials required for upload (PR:H); scope changes (S:C) because any user accessing the stored file is impacted; no availability impact applies.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Ech0 before 4.4.3 contains a stored cross-site scripting vulnerability in the file upload endpoint that validates Content-Type using only client-supplied headers without server-side inspection. Attackers with admin privileges can upload SVG or HTML files containing JavaScript that executes in the application origin when accessed by any user, enabling session hijacking and data exfiltration.
AnalysisAI
Stored cross-site scripting in Ech0 before 4.4.3 allows authenticated administrators to upload SVG or HTML files containing arbitrary JavaScript that executes in the application origin when accessed by any user, enabling session hijacking and credential exfiltration. The file upload handler at internal/service/file/file.go trusts the client-supplied multipart Content-Type header without server-side magic byte detection or extension validation, and SVG uploads are permitted in the default AllowedTypes configuration without any bypass required. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated session with Ech0 administrative privileges (PR:H confirmed by CVSS 4.0 vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 4.8 accurately reflects the elevated privilege prerequisite (PR:H): exploitation requires a compromised or malicious administrator account, positioning this as an insider threat or post-compromise lateral-impact scenario rather than an opportunistic external attack. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained administrator credentials - through phishing, credential stuffing, or insider access - logs into Ech0 and uploads a crafted SVG file containing an embedded script element that exfiltrates the document.cookie value to an attacker-controlled endpoint; since image/svg+xml is permitted by default, no Content-Type manipulation is required. The file is stored with its original .svg extension and immediately accessible to all users at /api/files/images/<key>.svg via the unauthenticated static route. … |
| Remediation | Upgrade Ech0 to version 4.4.3 or later; this is the vendor-confirmed fixed release per package metadata and the security advisory at https://github.com/lin-snow/Ech0/security/advisories/GHSA-69hx-63pv-f8f4. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Persistent authentication bypass in Ech0 (lin-snow's self-hosted lightweight publishing/memo app) before 4.7.3 lets an a
OAuth redirect URI validation in Ech0 through 4.5.6 allows session hijacking via exchange-code theft by exploiting incom
Denial of service in Ech0 before 5.0.1 allows unauthenticated remote attackers to saturate server CPU by exploiting a qu
Authorization bypass in Ech0 before 4.5.1 allows any authenticated non-admin user to invoke privileged admin endpoints b
Privilege escalation in Ech0 before 4.4.3 allows an attacker holding an admin's profile:read access token to change the
Server-side request forgery in Ech0 before version 4.7.3 allows authenticated users to pivot through the application ser
Scope enforcement in Ech0 4.3.4 and earlier is opt-in at the route level, meaning privileged admin routes that omit the
Missing administrator authorization on dashboard log endpoints in Ech0 before 4.4.3 allows any authenticated low-privile
Scope enforcement bypass in Ech0's comment panel admin API allows any holder of a valid admin-issued access token - rega
Unauthenticated metric inflation in Ech0 before 4.7.3 allows any remote attacker to arbitrarily increment the fav_count
Unauthenticated remote attackers can increment the fav_count of any echo - including private ones - in Ech0 through 4.5.
Ech0 before version 4.7.3 exposes guest commenter email addresses to unauthenticated remote callers via public comment-l
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today