CVE-2026-79670: Ech0 Stored XSS Vulnerability

CVE-2026-79670 Overview

CVE-2026-79670 is a stored cross-site scripting (XSS) vulnerability in Ech0 versions before 4.4.3. The file upload endpoint validates Content-Type using only client-supplied headers without server-side inspection of file contents. An authenticated administrator can upload SVG or HTML files containing JavaScript payloads. When any user later accesses the uploaded file, the script executes in the application origin. Successful exploitation enables session hijacking, data exfiltration, and further account compromise. The weakness is categorized under [CWE-434: Unrestricted Upload of File with Dangerous Type].

Critical Impact
Attackers with admin credentials can plant persistent JavaScript that runs against every visitor of the affected Ech0 instance, enabling session theft and exfiltration of authenticated user data.

Affected Products

Ech0 versions prior to 4.4.3
Self-hosted Ech0 deployments exposing the file upload endpoint
Any Ech0 instance where administrator accounts can be reached over the network

Discovery Timeline

2026-08-25 - CVE-2026-79670 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-79670

Vulnerability Analysis

Ech0 accepts file uploads through an administrator-facing endpoint and stores them for later retrieval by any application user. The server trusts the Content-Type value the client sends in the multipart upload request. It does not inspect the actual bytes of the uploaded file, nor does it enforce an allow-list of safe MIME types tied to server-side detection.

Because SVG and HTML files can embed inline <script> tags and event handlers, an attacker can craft a file that browsers render as active content. When a user requests the uploaded resource, the browser executes the embedded JavaScript in the origin of the Ech0 application. The script gains access to same-origin cookies, localStorage, and any authenticated API endpoints exposed to the victim's session.

The scope is bounded by the requirement for high privileges (admin) to reach the upload endpoint, but the payload persists and affects every viewer that follows a link to the malicious file.

Root Cause

The upload handler relies exclusively on client-declared metadata to decide whether an uploaded file is acceptable. Server-side content sniffing, magic-byte inspection, and SVG sanitization are absent. The vulnerability is a classic instance of [CWE-434], compounded by serving user-uploaded content from the application origin rather than an isolated domain.

Attack Vector

An attacker with administrator access authenticates to Ech0 and submits a multipart file upload. The request declares a benign Content-Type such as image/png while the body contains an SVG or HTML document with embedded JavaScript. The server stores the file and later serves it with a MIME type that causes the browser to render the payload. Any user who navigates to the file URL, including through a link placed in application content, triggers script execution inside the Ech0 origin.

No verified public exploit code is available. See the GitHub Security Advisory and the VulnCheck Advisory on XSS for vendor-authored technical detail.

Detection Methods for CVE-2026-79670

Indicators of Compromise

Uploaded files with .svg or .html extensions, or files whose contents contain <script>, onload=, or onerror= handlers, stored under the Ech0 uploads directory.
Multipart upload requests where the declared Content-Type does not match the file's magic bytes.
Outbound requests from user browsers to unexpected domains shortly after loading Ech0 pages that reference uploaded assets.

Detection Strategies

Scan the Ech0 upload directory for SVG and HTML files and inspect them for embedded scripting constructs.
Review web server access logs for POST requests to the upload endpoint from administrator sessions, followed by GET requests to the resulting file paths.
Alert on responses served from the Ech0 origin with Content-Type: image/svg+xml or text/html that were sourced from user-controlled paths.

Monitoring Recommendations

Track administrator account activity, especially file uploads occurring outside normal maintenance windows.
Monitor Content Security Policy (CSP) violation reports from the Ech0 application, which will surface injected script attempts.
Correlate authentication events with unusual data egress patterns to identify session hijacking following a successful XSS.

How to Mitigate CVE-2026-79670

Immediate Actions Required

Upgrade Ech0 to version 4.4.3 or later, which addresses the missing server-side content validation.
Audit existing uploads and remove any SVG or HTML files that were not deliberately placed by trusted administrators.
Rotate administrator credentials and invalidate active sessions if unauthorized uploads are found.

Patch Information

The fix ships in Ech0 4.4.3. Refer to the GitHub Security Advisory for the exact commit and release notes.

Workarounds

Restrict access to the Ech0 administrative interface using network controls or authentication proxies until the patch is applied.
Serve uploaded files from a separate, sandboxed origin so that any embedded script cannot access Ech0 session cookies.
Deploy a strict Content Security Policy that disallows inline scripts and constrains permitted script sources.

bash

# Example nginx configuration to force downloads and set a strict CSP
location /uploads/ {
    add_header Content-Disposition "attachment";
    add_header X-Content-Type-Options "nosniff";
    add_header Content-Security-Policy "default-src 'none'; sandbox;";
}