CVE-2026-118658

Name of the Vulnerable Software and Affected Versions Echo versions prior to 4.15.2 Echo versions prior to 5.1.1

Description The Scheme() function in the Echo web framework trusts the X-Forwarded-Proto, X-Forwarded-Protocol, and X-Url-Scheme request headers without validating that the values are supported web schemes. The WWWRedirect() and NonWWWRedirect() middlewares use this unsanitized value to construct a Location response header. An attacker controlling these headers can inject arbitrary URI schemes, such as javascript, data, vbscript, file, ftp, ssh, telnet, or gopher, leading to open redirects or cache poisoning when the application is not behind a proxy that strips these headers.

Recommendations Update Echo to version 4.15.2 or later. Update Echo to version 5.1.1 or later. As a temporary workaround, configure the edge proxy to overwrite or remove the X-Forwarded-Proto, X-Forwarded-Protocol, and X-Url-Scheme request headers.