CVE-2026-79670: Unrestricted Upload of File with Dangerous Type in lin-snow Ech0

CVE-2026-79670 describes a stored cross-site scripting vulnerability in lin-snow Ech0 prior to version 4.4.3. The flaw exists in the file upload endpoint where Content-Type validation relies only on client-supplied headers, lacking server-side inspection. This permits attackers with administrative privileges to upload files such as SVG or HTML containing embedded JavaScript. The malicious script executes in the context of the application when accessed by users, which can lead to session hijacking and data theft.

Attackers with admin privileges can exploit this vulnerability to upload malicious files that execute JavaScript in the application's origin. This can result in session hijacking and unauthorized data exfiltration from users who access the uploaded files. The vulnerability requires administrative access to exploit and involves user interaction to trigger the malicious script.

A fixed version is available in Ech0 4.4.3. Users should upgrade to version 4.4.3 or later to remediate this vulnerability. Until upgrading, restrict administrative access to trusted personnel and avoid accessing uploaded files from untrusted sources. Patch status is confirmed by the affectedVersions field indicating versions before 4.4.3 are vulnerable.