CVE-2026-79670

MediumCVSS 4.8/10Last modified Aug 31, 2026

Description

Ech0 before 4.4.3 contains a stored cross-site scripting vulnerability in the file upload endpoint that validates Content-Type using only client-supplied headers without server-side inspection. Attackers with admin privileges can upload SVG or HTML files containing JavaScript that executes in the application origin when accessed by any user, enabling session hijacking and data exfiltration.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Aug 25, 2026
Last modified: Aug 31, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-796715.5Ech0 before 4.4.3 contains a server-side request forgery vulnerability in the validateWebhookURL function (webhook_setting_service.go), whic CVE-2026-796725.5Ech0 before 4.4.3 fails to enforce scope-based authorization on nine comment panel admin endpoints, allowing access tokens with minimal scop CVE-2026-796736.5Ech0 before 4.4.3 protects the PUT /user endpoint with the profile:read scope, a read-only scope, but allows write operations including pass CVE-2026-796748.2NLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader constructors that allows attackers to read files ou CVE-2026-796759.8NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java() function, allowing attackers to CVE-2026-796765.9NLTK versions before 3.10.3 contain a path traversal vulnerability in corpus readers that reopen root-derived paths using built-in open() in CVE-2026-796777.5Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat allows a denial of servi CVE-2026-796788.1A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() c CVE-2026-796798.7Use of Weak Credentials vulnerability in B&R Industrial Automation GmbH mapp Audit used in mapp Services. This issue affects mapp Audit use CVE-2026-79683.1Insufficient validation of untrusted input in CORS in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the CVE-2026-796804.5Authentication bypass vulnerability in the password authentication mechanism of the Qt VNC Server module. An attacker using a specially modi CVE-2026-796828.8Dell PowerStore contains a Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vul