CVE-2026-55086
MediumCVSS 4.2Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Etherpad prior to version 3.1.0 generates temporary filenames using Math.random() and places them in the system temp directory. A local attacker who predicts the filename can create a symbolic link to a file writable by the Etherpad process, allowing overwrite with partially attacker-controlled content during import or export.
Risk Assessment
The risk includes local privilege escalation or file corruption if the attacker has access to the shared temporary directory. This could lead to data integrity compromise.
Recommendation
Upgrade Etherpad to version 3.1.0 or later. Also, use secure filename generators and protect the temporary directory from unauthorized access.
Original NVD description (English source)
Etherpad is a real-time collaborative editor. Prior to 3.1.0, src/node/handler/ImportHandler.ts and src/node/handler/ExportHandler.ts derive temporary filenames from Math.random() and place them in os.tmpdir(). On a host with a shared world-writable temporary directory, a local unprivileged attacker who predicts a filename can precreate a symbolic link to a file writable by the Etherpad process. Subsequent import or export operations can follow the link through fs.writeFile, fs.rename, or document-conversion output and overwrite the target with partially attacker-controlled content. This issue is fixed in version 3.1.0.