CVE-2026-79670: Ech0 before 4.4.3 Stored XSS via SVG Upload
Ech0 before 4.4.3 contains a stored cross-site scripting vulnerability in the file upload endpoint that validates Content-Type using only client-supplied headers without server-side inspection. Attackers with admin privileges can upload SVG or HTML files containing JavaScript that executes in the application origin when accessed by any user, enabling session hijacking and data exfiltration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ech0to a version that resolves this vulnerability.Fixed in 4.4.3 - Configuration
Fix the stored XSS in the file upload endpoint by validating/inspecting uploaded files server-side (not only Content-Type from client-supplied headers) to prevent SVG/HTML files with embedded JavaScript from being stored and executed on access.
file upload endpoint server-side Content-Type inspection = enabled
Event History
Frequently Asked Questions
Who can exploit this vulnerability, and who is at risk from viewing the uploaded file?
Exploitation requires administrator privileges to use the upload endpoint. Any user who accesses the malicious SVG or HTML file can have JavaScript execute in the Ech0 application origin.
What conditions are required for successful exploitation?
An attacker must be able to authenticate as an administrator and upload an SVG or HTML file with JavaScript while supplying an acceptable client-controlled Content-Type header. A victim must then access the uploaded file.
Which versions are affected?
Ech0 versions before 4.4.3 are affected. Version 4.4.3 is not identified as affected by the provided advisory information.
What is the impact if exploitation succeeds?
Script executing in the application origin can enable session hijacking and data exfiltration. The stated severity vector also indicates low confidentiality and integrity impact, with no availability impact.