CyberRota Analysis
AI-GeneratedEch0 versions prior to 4.4.3 are vulnerable to a stored cross-site scripting flaw in the file upload endpoint, which improperly validates Content-Type based solely on client-supplied headers. This allows attackers with admin privileges to upload malicious SVG or HTML files that execute JavaScript in the application context, potentially leading to session hijacking and data exfiltration. Organizations using affected versions should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Ech0 before 4.4.3 contains a stored cross-site scripting vulnerability in the file upload endpoint that validates Content-Type using only client-supplied headers without server-side inspection. Attackers with admin privileges can upload SVG or HTML files containing JavaScript that executes in the application origin when accessed by any user, enabling session hijacking and data exfiltration.