CVE-2026-79670: Ech0 before 4.4.3 Stored XSS via SVG Upload

Severity: medium (CVSS 4.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-25 · updated 2026-08-31
Weakness: CWE-434

Description

Ech0 before 4.4.3 contains a stored cross-site scripting vulnerability in the file upload endpoint that validates Content-Type using only client-supplied headers without server-side inspection. Attackers with admin privileges can upload SVG or HTML files containing JavaScript that executes in the application origin when accessed by any user, enabling session hijacking and data exfiltration.

Affected products

lin-snow Ech0: before 4.4.3 — fixed in 4.4.3

How to fix

Upgrade to a fixed version: lin-snow Ech0 4.4.3. Check the vendor advisory for mitigations.

References

https://github.com/lin-snow/Ech0/security/advisories/GHSA-69hx-63pv-f8f4
https://www.vulncheck.com/advisories/ech0-before-stored-xss-via-svg-upload
https://github.com/lin-snow/Ech0/security/advisories/GHSA-69hx-63pv-f8f4

Get alerted when CVE-2026-79670 or the next vulnerability affects your stack