CVE-2026-35037General(ech0 / ech0)

LOWCVSS 7.2 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to 4.2.8, the GET /api/website/title endpoint accepts an arbitrary URL via the website_url query parameter and makes a server-side HTTP request to it without any validation of the target host or IP address. The endpoint requires no authentication. An attacker can use this to reach internal network services, cloud metadata endpoints (169.254.169.254), and localhost-bound services, with partial response data exfiltrated via the HTML <title> tag extraction This vulnerability is fixed in 4.2.8.

ech0 CVEs Back to dashboard

1.5/ 10 priority

Sources & remediation

Exploit / PoC references

https://github.com/lin-snow/Ech0/security/advisories/GHSA-cqgf-f4x7-g6wc

Weakness type (CWE)

CWE-918

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

ech0

Threat summary

Public PoC is present in monitored signal
2 mentions across 2 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Technical details provided in 2 signals
General: 1 classified signal
Disclosure: 1 classified signal
Peaked 1d ago at 1 mentions (2026-04-06); latest day: 1
2 total mentions across 2 days

Affected systems

Vendors

ech0

Products

ech0

Deep dive

Activity timeline2 mentions / 2d

Signal classification2 categories

General

150.0%

Disclosure

150.0%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-06	1	General1
2026-08-20	1	Disclosure1

Full discourse2 posts

pdnuclei-bot@pdnuclei_bot51d
Disclosure
🚨 CVE-2026-35037 - high 🚨 Ech0 < 4.2.8 - Server-Side Request Forgery > Ech0 before 4.2.8 exposes an unauthenticated SSRF vulnerability in GET /api/website/t... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-35037 @pdnuclei #NucleiTemplates #cve
Post summary
The tweet announces CVE‑2026‑35037, an unauthenticated SSRF vulnerability in Ech0 versions before 4.2.8, and links to a Nuclei template, but offers no exploit, patch, or active exploitation details.
00023347
1.3K followersView on X
CVE@CVEnew186d
General
CVE-2026-35037 Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to 4.2.8, the GET /api/website/title endpoint accepts an arbitrary URL via th… https://www.cve.org/CVERecord?id=CVE-2026-35037
Post summary
The text notes a vulnerability in Ech0’s API that allows arbitrary URL input, but provides no indication of active exploitation, patching, or PoC.
00000107
57.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	ech0	ech0	-	-	-

Explore more

Back to dashboard ech0 CVEs ech0 vulnerabilities