---
id: "CVE-2026-118658"
kind: "vulnerability"
aliases: ["CVE-2026-118658", "GHSA-23wf-92cp-8pcj"]
title: "Echo has Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto"
severity: "medium"
cvss: 4.7
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/labstack/echo/v5", "fixed": ["5.1.1"], "affected": "< 5.1.1", "ecosystem": "go"}, {"name": "github.com/labstack/echo/v4", "fixed": ["4.15.2"], "affected": "< 4.15.2", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["behind-cdn", "cwe-601", "echo", "go", "package", "self-hosted"]
not_affected_if: ["https-redirect-only", "no-www-redirect-middleware", "proxy-strips-forwarded-headers"]
published_at: "2026-10-28T21:04:10+00:00"
first_seen_at: "2026-10-28T21:07:45+00:00"
updated_at: "2026-10-28T21:09:31+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-23wf-92cp-8pcj", "first_seen_at": "2026-10-28T21:07:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118658", "first_seen_at": "2026-10-28T21:35:45+00:00"}]
---

# Echo has Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto

Echo's WWWRedirect and NonWWWRedirect middlewares build the Location header from the X-Forwarded-Proto request header without validating it. An attacker can make the server return a redirect to a javascript, data, file or similar scheme URL, enabling open redirects and possible cache poisoning behind a CDN.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/labstack/echo/v5 affected < 5.1.1 fixed 5.1.1
- go:github.com/labstack/echo/v4 affected < 4.15.2 fixed 4.15.2

## How to check

- Run `go list -m github.com/labstack/echo/v5` and `go list -m github.com/labstack/echo/v4` to read the Echo versions in the module graph.
- Search the code for `WWWRedirect(` or `NonWWWRedirect(` to see whether the affected middleware is in use.

## Fix

- Upgrade `github.com/labstack/echo/v5` to `5.1.1` or later.
- Upgrade `github.com/labstack/echo/v4` to `4.15.2` or later.
- If upgrading is not possible, have the edge proxy overwrite or remove the `X-Forwarded-Proto`, `X-Forwarded-Protocol` and `X-Url-Scheme` request headers.

## Timeline

- 2026-10-28T21:07:45+00:00 ghsa https://github.com/advisories/GHSA-23wf-92cp-8pcj
- 2026-10-28T21:35:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118658

## From the sources

## Summary

The `c.Scheme()` method in Echo (`context.go:162-181`) trusts the `X-Forwarded-Proto`, `X-Forwarded-Protocol`, and `X-Url-Scheme` request headers without validating that the value is `http` or `https`. The `WWWRedirect()` and `NonWWWRedirect()` middlewares use this unsanitized scheme to construct redirect URLs, allowing an attacker to inject arbitrary URI schemes into the `Location` response header.

## Affected Components

- `context.go:162-181` - `Scheme()` method returns attacker-controlled value verbatim
- `middleware/redirect.go:172-184` - `redirectWWW`/`redirectNonWWW` use unsanitized scheme

## Proof of Concept

```
GET /path HTTP/1.1
Host: example.com
X-Forwarded-Proto: javascript

Response:
HTTP/1.1 301 Moved Permanently
Location: javascript://www.example.com/path
```

Confirmed injectable schemes: `javascript`, `data`, `vbscript`, `file`, `ftp`, `ssh`, `telnet`, `gopher`.

Only `WWWRedirect()` and `NonWWWRedirect()` (and `WithConfig` variants) are affected. `HTTPSRedirect`, `HTTPSWWWRedirect`, `HTTPSNonWWWRedirect` are NOT affected (they hardcode `https://`).

## Impact

- Open redirect to arbitrary scheme URLs when app is not behind a proxy that strips `X-Forwarded-Proto`
- Cache poisoning when behind a CDN that caches redirect responses keyed by path
- `file://` scheme injection could trigger file access in some browser configurations

## Suggested Fix

Whitelist scheme in `c.Scheme()` to only return `http` or `https`:

```go
func (c *Context) Scheme() string {
    if c.IsTLS() {
        return "https"
    }
    if scheme := c.request.Header.Get(HeaderXForwardedProto); scheme != "" {
        scheme = strings.ToLower(strings.TrimSpace(scheme))
        if scheme == "https" {
            return "https"
        }
    }
    return "http"
}
```

## Disclosure

Source code review, manually verified with actual HTTP server. Tested on Echo v5.0.4 (latest master).

## Patches

Fixed in `github.com/labstack/echo/v5` v5.1.1 and `github.com/labstack/echo/v4` v4.15.2. `Context.Scheme()` now accepts only `http`, `https`, `ws` or `wss` from the `X-Forwarded-Proto`, `X-Forwarded-Protocol` and `X-Url-Scheme` headers, and falls back to `http` for any other value (#2953).

## Workarounds

Upgrade to a patched version. If you cannot upgrade, have your edge proxy overwrite or remove the `X-Forwarded-Proto`, `X-Forwarded-Protocol` and `X-Url-Scheme` request headers.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_