CVE-2026-35037 Ech0 affected by unauthenticated SSRF in GetWebsiteTitle allows access to internal services and cloud metadata

What is CVE-2026-35037?

CVE-2026-35037 is a high-severity server-side request forgery vulnerability in lin-snow Ech0, published on 6 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to 4.2.8, the GET /api/website/title endpoint accepts an arbitrary URL via the website_url query parameter and makes a server-side HTTP request to it without any validation of the target host or IP address. The endpoint requires no authentication. An attacker can use this to reach internal network services, cloud metadata endpoints (169.254.169.254), and localhost-bound services, with partial response data exfiltrated via the HTML <title> tag extraction This vulnerability is fixed in 4.2.8.

Weakness: CWE-918

Which versions are affected by CVE-2026-35037?

3 open source packages ship an affected version, including github.com/lin-snow/ech0. It affects 1 product.

Products include Ech0 Ech0.

How do I fix CVE-2026-35037?

Upgrade github.com/lin-snow/ech0 to 1.4.8-0.20260401031029-4ca56fea5ba4 or later.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2026-35037 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-35037 exists.

Public exploit code: 1 Nuclei template and 1 proofs of concept on GitHub.

Other vulnerabilities in lin-snow Ech0

• CVE-2026-35036 Ech0 Affected by Unauthenticated Server-Side Request Forgery in Website Preview Feature High 7.5
• CVE-2026-33638 Ech0 authenticated user-list exposed data via public `/api/allusers` endpoint Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-cqgf-f4x7-g6wc, GO-2026-5331.