CVE-2026-55087
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
Etherpad versions 2.1.0 to 3.1.0 use the attacker-controlled x-proxy-path header when substituting paths into HTML, JavaScript, and CSS under /admin without sanitization, Vary, or Cache-Control. A shared proxy or CDN can cache the response and serve attacker-injected script to an administrator. Version 3.0.0 also accepts a protocol-relative x-proxy-path value, allowing redirection to an attacker-controlled host.
Risk Assessment
The risk includes XSS attacks on administrators, session hijacking, and redirects to malicious sites. The vulnerability is exploitable when the header can be controlled by the client.
Recommendation
Upgrade Etherpad to version 3.1.0 or later. Also, configure the server to ignore or sanitize the x-proxy-path header from clients.
Other vulnerabilities in Etherpad
See all- CVE-2026-55089Critical
Etherpad from version 2.1.0 to 3.1.0 contains an authorization vulnerability in the API that allows a non-admin user with a valid token to invoke administrative functions such as modifying, deleting, or disclosing pads.
- CVE-2026-55085Critical
Etherpad before version 3.3.1 contains an XSS vulnerability in the import functionality that allows a user with write access to a pad to store malicious markup that executes when other users, including administrators, open the pad.
- CVE-2026-55090Medium
Etherpad, a real-time collaborative editor, prior to version 3.3.0 has a stored XSS vulnerability in getHTMLFromAtext where values from the exportHtmlAdditionalTagsWithData plugin hook are interpolated into span data attributes without HTML attribute escaping. A pad editor can place an attacker-controlled value into the attribute pool, and opening the HTML export executes the script in the Etherpad origin.
- CVE-2026-55088Medium
Etherpad versions 2.6.0 to 3.1.0 have a vulnerability in the token transfer mechanism where an author token is stored and exposed via GET /tokenTransfer/{uuid} without expiration or removal after redemption. An unauthenticated attacker who obtains the UUID can repeatedly redeem it, receive fresh author cookies, and impersonate the author.
- CVE-2026-55086Medium
Etherpad prior to version 3.1.0 generates temporary filenames using Math.random() and places them in the system temp directory. A local attacker who predicts the filename can create a symbolic link to a file writable by the Etherpad process, allowing overwrite with partially attacker-controlled content during import or export.
Original NVD description (English source)
Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad uses the attacker-controlled x-proxy-path request header in src/node/hooks/express/admin.ts when substituting paths into HTML, JavaScript, and CSS under /admin without sanitization, Vary: x-proxy-path, or Cache-Control: private, no-store. A shared proxy or CDN can cache the resulting response and serve attacker-injected script to an administrator. In src/node/hooks/express/specialpages.ts, version 3.0.0 also accepts a protocol-relative x-proxy-path value when constructing the /p/:pad/timeslider redirect, allowing redirection to an attacker-controlled host. The issues are exploitable when the deployment permits client-supplied x-proxy-path headers to reach Etherpad. This issue is fixed in version 3.1.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS