CVE-2026-55085

Etherpad from version 2.1.0 to 3.1.0 contains an authorization vulnerability in the API that allows a non-admin user with a valid token to invoke administrative functions such as modifying, deleting, or disclosing pads.

Etherpad, a real-time collaborative editor, prior to version 3.3.0 has a stored XSS vulnerability in getHTMLFromAtext where values from the exportHtmlAdditionalTagsWithData plugin hook are interpolated into span data attributes without HTML attribute escaping. A pad editor can place an attacker-controlled value into the attribute pool, and opening the HTML export executes the script in the Etherpad origin.

Etherpad versions 2.6.0 to 3.1.0 have a vulnerability in the token transfer mechanism where an author token is stored and exposed via GET /tokenTransfer/{uuid} without expiration or removal after redemption. An unauthenticated attacker who obtains the UUID can repeatedly redeem it, receive fresh author cookies, and impersonate the author.

Etherpad versions 2.1.0 to 3.1.0 use the attacker-controlled x-proxy-path header when substituting paths into HTML, JavaScript, and CSS under /admin without sanitization, Vary, or Cache-Control. A shared proxy or CDN can cache the response and serve attacker-injected script to an administrator. Version 3.0.0 also accepts a protocol-relative x-proxy-path value, allowing redirection to an attacker-controlled host.

Etherpad prior to version 3.1.0 generates temporary filenames using Math.random() and places them in the system temp directory. A local attacker who predicts the filename can create a symbolic link to a file writable by the Etherpad process, allowing overwrite with partially attacker-controlled content during import or export.