## Echo has Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto

- 種別: advisory
- 重大度: medium
- 関連技術: go, github
- CVE: CVE-2026-118658
- 公開日時: 2026-10-28T21:04:10.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-23wf-92cp-8pcj)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-23wf-92cp-8pcj

影響: go:github.com/labstack/echo/v5 < 5.1.1 → 5.1.1, go:github.com/labstack/echo/v4 < 4.15.2 → 4.15.2
The c.Scheme() method in Echo (context.go:162-181) trusts the X-Forwarded-Proto, X-Forwarded-Protocol, and X-Url-Scheme request headers without validating that the value is http or https. The WWWRedirect() and NonWWWRedirect() middlewares use this unsanitized scheme to construct redirect URLs, allowing an attacker to inject arbitrary URI schemes into the Location response header. Affected Components - context.go:162-181 - Scheme() method returns attacker-controlled value verbatim - middleware/r…