Echo has Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto
CVE-2026-118658
Summary The c.Scheme() method in Echo (context.go:162-181) trusts the X-Forwarded-Proto, X-Forwarded-Protocol, and X-Url-Scheme request headers without validating that the value is http or https. The WWWRedirect() and NonWWWRedirect() middlewares use this unsanitized scheme to construct redirect URLs, allowing an attacker to inject arbitrary URI schemes into the Location response header. Affected Components context.go:162-181 - Scheme() method returns attacker-controlled value verbatim middleware/redirect.go:172-184 - redirectWWW/redirectNonWWW use unsanitized scheme Proof of Concept GET /path HTTP/1.1 Host: example.com X-Forwarded-Proto: javascript Response: HTTP/1.1 301 Moved Permanently Location: javascript://www.example.com/path Confirmed injectable schemes: javascript, data, vbscript, file, ftp, ssh, telnet, gopher. Only WWWRedirect() and NonWWWRedirect() (and WithConfig variants) are affected. HTTPSRedirect, HTTPSWWWRedirect, HTTPSNonWWWRedirect are NOT affected (they hardcode https://). Impact Open redirect to arbitrary scheme URLs when app is not behind a proxy that strips X-Forwarded-Proto Cache poisoning when behind a CDN that caches redirect responses keyed by path…
Assessment
- CVSS
- 4.7 (v3.1)
- Severity
- Medium
- EPSS
- 0.00186% chance of exploitation in the next 30 days
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 28 October 2026
- Last updated
- 31 October 2026
- Affected
- go · github.com/labstack/echo/v5, github.com/labstack/echo/v4
- Weakness
- CWE-601
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
At the source
References
- https://github.com/labstack/echo/security/advisories/GHSA-23wf-92cp-8pcj
- https://github.com/labstack/echo/pull/2953
- https://github.com/labstack/echo/commit/ca4f38a474302aabee93c66bdd0052359882e181
- https://github.com/labstack/echo/commit/d1d8ad3f99dd9b80542cd0c357d56a8916c515df
- https://github.com/labstack/echo/releases/tag/v4.15.2
- https://github.com/labstack/echo/releases/tag/v5.1.1
- https://github.com/advisories/GHSA-23wf-92cp-8pcj
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-118658