Stored Cross-Site Scripting Vulnerability in Ech0 by Lin Snow

CVE-2026-79670

What is CVE-2026-79670?

Ech0, prior to version 4.4.3, has a stored cross-site scripting vulnerability found in its file upload functionality. This vulnerability arises because the application validates Content-Type solely based on client-supplied headers, neglecting server-side validation. As a result, attackers with administrative access can upload SVG or HTML files that contain malicious JavaScript code. This malicious code is executed within the application’s origin whenever the file is accessed by any user, creating an opportunity for session hijacking and potential data exfiltration.

References