---
id: CVE-2026-118658
aliases:
  - GHSA-23wf-92cp-8pcj
title: >-
  Echo has Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares
  via X-Forwarded-Proto
summary: >-
  Echo has Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares
  via X-Forwarded-Proto
severity: medium
cvss: 4.7
cwe:
  - CWE-601
vendor: labstack
product: github.com/labstack/echo/v5
ecosystem: go
affected:
  - github.com/labstack/echo/v5 < 5.1.1
  - github.com/labstack/echo/v4 < 4.15.2
patched:
  - github.com/labstack/echo/v5 5.1.1
  - github.com/labstack/echo/v4 4.15.2
published: '2026-10-28'
updated: '2026-10-31'
sourceUpdated: '2026-10-31T12:39:21Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-23wf-92cp-8pcj'
references:
  - url: 'https://github.com/labstack/echo/security/advisories/GHSA-23wf-92cp-8pcj'
  - url: 'https://github.com/labstack/echo/pull/2953'
  - url: >-
      https://github.com/labstack/echo/commit/ca4f38a474302aabee93c66bdd0052359882e181
  - url: >-
      https://github.com/labstack/echo/commit/d1d8ad3f99dd9b80542cd0c357d56a8916c515df
  - url: 'https://github.com/labstack/echo/releases/tag/v4.15.2'
  - url: 'https://github.com/labstack/echo/releases/tag/v5.1.1'
  - url: 'https://github.com/advisories/GHSA-23wf-92cp-8pcj'
  - url: 'https://github.com/labstack/echo'
tags:
  - ghsa
  - go
  - cve.org
  - osv
epss: 0.00186
epssPercentile: 0.08179
ingestedAt: '2026-10-28T21:18:49.948Z'
---

## Overview

## Summary

The `c.Scheme()` method in Echo (`context.go:162-181`) trusts the `X-Forwarded-Proto`, `X-Forwarded-Protocol`, and `X-Url-Scheme` request headers without validating that the value is `http` or `https`. The `WWWRedirect()` and `NonWWWRedirect()` middlewares use this unsanitized scheme to construct redirect URLs, allowing an attacker to inject arbitrary URI schemes into the `Location` response header.

## Affected Components

- `context.go:162-181` - `Scheme()` method returns attacker-controlled value verbatim
- `middleware/redirect.go:172-184` - `redirectWWW`/`redirectNonWWW` use unsanitized scheme

## Proof of Concept

```
GET /path HTTP/1.1
Host: example.com
X-Forwarded-Proto: javascript

Response:
HTTP/1.1 301 Moved Permanently
Location: javascript://www.example.com/path
```

Confirmed injectable schemes: `javascript`, `data`, `vbscript`, `file`, `ftp`, `ssh`, `telnet`, `gopher`.

Only `WWWRedirect()` and `NonWWWRedirect()` (and `WithConfig` variants) are affected. `HTTPSRedirect`, `HTTPSWWWRedirect`, `HTTPSNonWWWRedirect` are NOT affected (they hardcode `https://`).

## Impact

- Open redirect to arbitrary scheme URLs when app is not behind a proxy that strips `X-Forwarded-Proto`
- Cache poisoning when behind a CDN that caches redirect responses keyed by path
- `file://` scheme injection could trigger file access in some browser configurations

## Suggested Fix

Whitelist scheme in `c.Scheme()` to only return `http` or `https`:

```go
func (c *Context) Scheme() string {
    if c.IsTLS() {
        return "https"
    }
    if scheme := c.request.Header.Get(HeaderXForwardedProto); scheme != "" {
        scheme = strings.ToLower(strings.TrimSpace(scheme))
        if scheme == "https" {
            return "https"
        }
    }
    return "http"
}
```

## Disclosure

Source code review, manually verified with actual HTTP server. Tested on Echo v5.0.4 (latest master).

## Patches

Fixed in `github.com/labstack/echo/v5` v5.1.1 and `github.com/labstack/echo/v4` v4.15.2. `Context.Scheme()` now accepts only `http`, `https`, `ws` or `wss` from the `X-Forwarded-Proto`, `X-Forwarded-Protocol` and `X-Url-Scheme` headers, and falls back to `http` for any other value (#2953).

## Workarounds

Upgrade to a patched version. If you cannot upgrade, have your edge proxy overwrite or remove the `X-Forwarded-Proto`, `X-Forwarded-Protocol` and `X-Url-Scheme` request headers.

## Affected packages

- `github.com/labstack/echo/v5 < 5.1.1`
- `github.com/labstack/echo/v4 < 4.15.2`

## Remediation

Upgrade to a patched release:

- `github.com/labstack/echo/v5 5.1.1`
- `github.com/labstack/echo/v4 4.15.2`