{"id":"CVE-2026-118658","aliases":["GHSA-23wf-92cp-8pcj"],"title":"Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto","titleSource":"GitHub_M","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"## Summary\n\nThe `c.Scheme()` method in Echo (`context.go:162-181`) trusts the `X-Forwarded-Proto`, `X-Forwarded-Protocol`, and `X-Url-Scheme` request headers without validating that the value is `http` or `https`. The `WWWRedirect()` and `NonWWWRedirect()` middlewares use this unsanitized scheme to construct redirect URLs, allowing an attacker to inject arbitrary URI schemes into the `Location` response header.\n\n## Affected Components\n\n- `context.go:162-181` - `Scheme()` method returns attacker-controlled value verbatim\n- `middleware/redirect.go:172-184` - `redirectWWW`/`redirectNonWWW` use unsanitized scheme\n\n## Proof of Concept\n\n```\nGET /path HTTP/1.1\nHost: example.com\nX-Forwarded-Proto: javascript\n\nResponse:\nHTTP/1.1 301 Moved Permanently\nLocation: javascript://www.example.com/path\n```\n\nConfirmed injectable schemes: `javascript`, `data`, `vbscript`, `file`, `ftp`, `ssh`, `telnet`, `gopher`.\n\nOnly `WWWRedirect()` and `NonWWWRedirect()` (and `WithConfig` variants) are affected. `HTTPSRedirect`, `HTTPSWWWRedirect`, `HTTPSNonWWWRedirect` are NOT affected (they hardcode `https://`).\n\n## Impact\n\n- Open redirect to arbitrary scheme URLs when app is not behind a proxy that strips `X-Forwarded-Proto`\n- Cache poisoning when behind a CDN that caches redirect responses keyed by path\n- `file://` scheme injection could trigger file access in some browser configurations\n\n## Suggested Fix\n\nWhitelist scheme in `c.Scheme()` to only return `http` or `https`:\n\n```go\nfunc (c *Context) Scheme() string {\n    if c.IsTLS() {\n        return \"https\"\n    }\n    if scheme := c.request.Header.Get(HeaderXForwardedProto); scheme != \"\" {\n        scheme = strings.ToLower(strings.TrimSpace(scheme))\n        if scheme == \"https\" {\n            return \"https\"\n        }\n    }\n    return \"http\"\n}\n```\n\n## Disclosure\n\nSource code review, manually verified with actual HTTP server. Tested on Echo v5.0.4 (latest master).\n\n## Patches\n\nFixed in `github.com/labstack/echo/v5` v5.1.1 and `github.com/labstack/echo/v4` v4.15.2. `Context.Scheme()` now accepts only `http`, `https`, `ws` or `wss` from the `X-Forwarded-Proto`, `X-Forwarded-Protocol` and `X-Url-Scheme` headers, and falls back to `http` for any other value (#2953).\n\n## Workarounds\n\nUpgrade to a patched version. If you cannot upgrade, have your edge proxy overwrite or remove the `X-Forwarded-Proto`, `X-Forwarded-Protocol` and `X-Url-Scheme` request headers.","severity":"medium","score":4.7,"published":"2026-10-28T20:17:11.083Z","modified":"2026-10-28T21:15:04.154Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Go","name":"github.com/labstack/echo/v5","sources":[{"name":"OSV · GHSA-23wf-92cp-8pcj","url":"https://osv.dev/vulnerability/GHSA-23wf-92cp-8pcj"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"5.1.1"}],"type":"SEMVER"}],"versions":[],"fixed":["5.1.1"]},{"ecosystem":"Go","name":"github.com/labstack/echo/v4","sources":[{"name":"OSV · GHSA-23wf-92cp-8pcj","url":"https://osv.dev/vulnerability/GHSA-23wf-92cp-8pcj"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"4.15.2"}],"type":"SEMVER"}],"versions":[],"fixed":["4.15.2"]}],"sourceAffected":[],"references":["https://github.com/labstack/echo/security/advisories/GHSA-23wf-92cp-8pcj","https://github.com/labstack/echo/commit/ca4f38a474302aabee93c66bdd0052359882e181","https://github.com/labstack/echo/commit/d1d8ad3f99dd9b80542cd0c357d56a8916c515df","https://github.com/labstack/echo/releases/tag/v4.15.2","https://github.com/labstack/echo/releases/tag/v5.1.1","https://github.com/labstack/echo/pull/2953","https://github.com/labstack/echo"],"sources":[{"name":"CVE","id":"CVE-2026-118658","modified":"2026-10-28T20:17:11.083Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-118658"},{"name":"OSV","id":"GHSA-23wf-92cp-8pcj","modified":"2026-10-28T21:15:04.154114654Z","url":"https://osv.dev/vulnerability/GHSA-23wf-92cp-8pcj"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","score":4.7},{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","score":4.7}],"cve":{"records":[{"id":"CVE-2026-118658","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-28T17:25:37.561Z","published":"2026-10-28T20:17:11.083Z","modified":"2026-10-28T20:17:11.083Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-28T20:17:11.083Z"}],"references":[{"url":"https://github.com/labstack/echo/security/advisories/GHSA-23wf-92cp-8pcj","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/labstack/echo/commit/ca4f38a474302aabee93c66bdd0052359882e181","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/labstack/echo/commit/d1d8ad3f99dd9b80542cd0c357d56a8916c515df","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/labstack/echo/releases/tag/v4.15.2","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/labstack/echo/releases/tag/v5.1.1","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-601","description":"CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","source":"GitHub_M"}],"applicability":[],"prioritization":[]},"products":[{"vendor":"labstack","name":"echo","platforms":[],"versions":[{"version":">= 5.0.0, < 5.1.1","status":"affected"},{"version":"< 4.15.2","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-118658"}],"remediation":[],"observedAt":"2026-10-29T14:54:05.872Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T00:50:33.640Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-28T23:40:32.733Z","attemptedAt":"2026-10-28T23:40:32.733Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-28T23:40:32.898Z","attemptedAt":"2026-10-28T23:40:32.898Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-28T23:40:32.166Z","attemptedAt":"2026-10-28T23:40:32.166Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-28T23:40:32.455Z","attemptedAt":"2026-10-28T23:40:32.455Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-112465","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-112465","modified":"Oct 28, 2026, 8:17:11 PM","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","checkedAt":"2026-10-28T23:40:32.166Z"},{"source":"NVD","id":"CVE-2026-118658","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118658","modified":"2026-10-28T21:16:55.827","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","checkedAt":"2026-10-28T23:40:32.733Z"},{"source":"GitHub Advisory Database","id":"GHSA-23wf-92cp-8pcj","url":"https://github.com/advisories/GHSA-23wf-92cp-8pcj","modified":"2026-10-28T21:04:12Z","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","checkedAt":"2026-10-28T23:40:32.898Z"}],"aiSummary":null}