Executive brief
Ech0 is a file management and sharing application. The file upload feature validates file types based only on user-supplied headers without checking actual file content, allowing authenticated administrators to upload malicious SVG or HTML files containing JavaScript code. When other users access these uploaded files, the JavaScript executes with full access to the application, enabling attackers to steal session tokens, hijack accounts, and exfiltrate sensitive data.
Technical details
Ech0 before 4.4.3 contains a stored cross-site scripting (XSS) vulnerability in the file upload endpoint (internal/service/file/file.go:85-87). The vulnerability stems from insufficient file type validation: the application checks only the client-supplied multipart Content-Type header via exact string matching in isAllowedType(), without performing server-side content inspection, magic byte detection, or file extension validation. Additionally, the original filename extension is preserved during storage, and uploaded files are served by an unauthenticated static file server (gin.Static at internal/router/modules.go:51) that determines Content-Type from file extension using Go's mime.TypeByExtension, bypassing the upload-time checks. An authenticated admin can exploit this by uploading SVG files (image/svg+xml is in the default allowed types) or spoofing the Content-Type to upload HTML files with embedded <script> tags. When any user accesses the file URL directly, the JavaScript executes in the application origin without authentication, enabling session hijacking and API access. The fix is available in Ech0 version 4.4.3 and later, which implements proper server-side content validation and likely adds X-Content-Type-Options and CSP headers.
Affected products
- lin-snow Ech0 before 4.4.3
Timeline
- 2026-04-09: disclosed: GitHub Security Advisory GHSA-69hx-63pv-f8f4 published
- 2026-08-25: advisory: CVE-2026-79670 published on NVD
- 2026-04-09: patched: Patched in version 4.4.3