CVE-2026-35037

CVE-2026-35037 is a server-side request forgery (SSRF) vulnerability in Ech0, an open-source self-hosted publishing platform, affecting versions prior to 4.2.8. The GET /api/website/title endpoint fails to validate URLs passed via the website_url query parameter before making server-side HTTP requests, allowing unauthenticated attackers to access internal network services, cloud metadata endpoints, and localhost-bound services. Partial response data can be exfiltrated through HTML title tag extraction. The vulnerability carries a CVSS score of 7.2 (HIGH) with a network-based attack vector requiring no authentication or user interaction, making it easily exploitable. The attack has low complexity and results in confidentiality and integrity impacts, though availability is not affected. The broader impact scope indicates potential compromise of connected systems beyond the vulnerable application itself. There is currently no evidence of active exploitation, with the vulnerability absent from public exploit databases and CISA's Known Exploited Vulnerabilities catalog. Community attention remains minimal based on EPSS metrics. Organizations running Ech0 should prioritize updating to version 4.2.8 or later to remediate this risk, particularly for instances exposed to untrusted networks or those with access to sensitive internal services.