{"id":"CVE-2026-118658","aliases":["GHSA-23wf-92cp-8pcj"],"title":"Echo has Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto","summary":"Echo has Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto","severity":"medium","cvss":4.7,"cwe":["CWE-601"],"vendor":"labstack","product":"github.com/labstack/echo/v5","ecosystem":"go","affected":["github.com/labstack/echo/v5 < 5.1.1","github.com/labstack/echo/v4 < 4.15.2"],"patched":["github.com/labstack/echo/v5 5.1.1","github.com/labstack/echo/v4 4.15.2"],"published":"2026-10-28","updated":"2026-10-31","sourceUpdated":"2026-10-31T12:39:21Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-23wf-92cp-8pcj","references":[{"url":"https://github.com/labstack/echo/security/advisories/GHSA-23wf-92cp-8pcj"},{"url":"https://github.com/labstack/echo/pull/2953"},{"url":"https://github.com/labstack/echo/commit/ca4f38a474302aabee93c66bdd0052359882e181"},{"url":"https://github.com/labstack/echo/commit/d1d8ad3f99dd9b80542cd0c357d56a8916c515df"},{"url":"https://github.com/labstack/echo/releases/tag/v4.15.2"},{"url":"https://github.com/labstack/echo/releases/tag/v5.1.1"},{"url":"https://github.com/advisories/GHSA-23wf-92cp-8pcj"},{"url":"https://github.com/labstack/echo"}],"tags":["ghsa","go","cve.org","osv"],"epss":0.00186,"epssPercentile":0.08179,"ingestedAt":"2026-10-28T21:18:49.948Z","slug":"CVE-2026-118658","body":"## Overview\n\n## Summary\n\nThe `c.Scheme()` method in Echo (`context.go:162-181`) trusts the `X-Forwarded-Proto`, `X-Forwarded-Protocol`, and `X-Url-Scheme` request headers without validating that the value is `http` or `https`. The `WWWRedirect()` and `NonWWWRedirect()` middlewares use this unsanitized scheme to construct redirect URLs, allowing an attacker to inject arbitrary URI schemes into the `Location` response header.\n\n## Affected Components\n\n- `context.go:162-181` - `Scheme()` method returns attacker-controlled value verbatim\n- `middleware/redirect.go:172-184` - `redirectWWW`/`redirectNonWWW` use unsanitized scheme\n\n## Proof of Concept\n\n```\nGET /path HTTP/1.1\nHost: example.com\nX-Forwarded-Proto: javascript\n\nResponse:\nHTTP/1.1 301 Moved Permanently\nLocation: javascript://www.example.com/path\n```\n\nConfirmed injectable schemes: `javascript`, `data`, `vbscript`, `file`, `ftp`, `ssh`, `telnet`, `gopher`.\n\nOnly `WWWRedirect()` and `NonWWWRedirect()` (and `WithConfig` variants) are affected. `HTTPSRedirect`, `HTTPSWWWRedirect`, `HTTPSNonWWWRedirect` are NOT affected (they hardcode `https://`).\n\n## Impact\n\n- Open redirect to arbitrary scheme URLs when app is not behind a proxy that strips `X-Forwarded-Proto`\n- Cache poisoning when behind a CDN that caches redirect responses keyed by path\n- `file://` scheme injection could trigger file access in some browser configurations\n\n## Suggested Fix\n\nWhitelist scheme in `c.Scheme()` to only return `http` or `https`:\n\n```go\nfunc (c *Context) Scheme() string {\n    if c.IsTLS() {\n        return \"https\"\n    }\n    if scheme := c.request.Header.Get(HeaderXForwardedProto); scheme != \"\" {\n        scheme = strings.ToLower(strings.TrimSpace(scheme))\n        if scheme == \"https\" {\n            return \"https\"\n        }\n    }\n    return \"http\"\n}\n```\n\n## Disclosure\n\nSource code review, manually verified with actual HTTP server. Tested on Echo v5.0.4 (latest master).\n\n## Patches\n\nFixed in `github.com/labstack/echo/v5` v5.1.1 and `github.com/labstack/echo/v4` v4.15.2. `Context.Scheme()` now accepts only `http`, `https`, `ws` or `wss` from the `X-Forwarded-Proto`, `X-Forwarded-Protocol` and `X-Url-Scheme` headers, and falls back to `http` for any other value (#2953).\n\n## Workarounds\n\nUpgrade to a patched version. If you cannot upgrade, have your edge proxy overwrite or remove the `X-Forwarded-Proto`, `X-Forwarded-Protocol` and `X-Url-Scheme` request headers.\n\n## Affected packages\n\n- `github.com/labstack/echo/v5 < 5.1.1`\n- `github.com/labstack/echo/v4 < 4.15.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/labstack/echo/v5 5.1.1`\n- `github.com/labstack/echo/v4 4.15.2`","depth":"sunlit","depthScore":26,"depthScoreParts":{"impact":25.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}