CVE-2026-79670: Ech0 stored cross-site scripting in file upload

CVE-2026-79670 · Severity: medium · CVSS 4.8 · Published 2026-08-25

Ech0 is a file management and sharing application. The file upload feature validates file types based only on user-supplied headers without checking actual file content, allowing authenticated administrators to upload malicious SVG or HTML files containing JavaScript code. When other users access these uploaded files, the JavaScript executes with full access to the application, enabling attackers to steal session tokens, hijack accounts, and exfiltrate sensitive data.

Technologies: github.com/lin-snow/ech0 (Go), Lin-Snow Ech0. Vendors: Go, Lin-Snow.

Quick answers

Is CVE-2026-79670 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-79670 being exploited in the wild.
How severe is CVE-2026-79670?
Medium severity, with a CVSS score of 4.8, published 25 August 2026.
Which products and versions are affected?
github.com/lin-snow/ech0 (Go) SEMVER:introduced=0, SEMVER:introduced=0,fixed=4.4.3; Lin-Snow Ech0 before 4.4.3.
Is there a fix for CVE-2026-79670?
Yes. github.com/lin-snow/ech0 (Go): upgrade to 4.4.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-79670 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-79670?
Check whether you run github.com/lin-snow/ech0 (Go) or Lin-Snow Ech0 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/lin-snow/ech0 (Go): upgrade to 4.4.3 or later
    go get github.com/lin-snow/ech0@v4.4.3

Technical details

Ech0 before 4.4.3 contains a stored cross-site scripting (XSS) vulnerability in the file upload endpoint (internal/service/file/file.go:85-87). The vulnerability stems from insufficient file type validation: the application checks only the client-supplied multipart Content-Type header via exact string matching in isAllowedType(), without performing server-side content inspection, magic byte detection, or file extension validation. Additionally, the original filename extension is preserved during storage, and uploaded files are served by an unauthenticated static file server (gin.Static at internal/router/modules.go:51) that determines Content-Type from file extension using Go's mime.TypeByExtension, bypassing the upload-time checks. An authenticated admin can exploit this by uploading SVG files (image/svg+xml is in the default allowed types) or spoofing the Content-Type to upload HTML files with embedded <script> tags. When any user accesses the file URL directly, the JavaScript executes in the application origin without authentication, enabling session hijacking and API access. The fix is available in Ech0 version 4.4.3 and later, which implements proper server-side content validation and likely adds X-Content-Type-Options and CSP headers.

Affected products

  • lin-snow Ech0 before 4.4.3

Identifiers

  • CVE-2026-79670
  • GHSA-69hx-63pv-f8f4
  • GO-2026-5172

Timeline

  • 2026-04-09: disclosed: GitHub Security Advisory GHSA-69hx-63pv-f8f4 published
  • 2026-08-25: advisory: CVE-2026-79670 published on NVD
  • 2026-04-09: patched: Patched in version 4.4.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.