{"id":"CVE-2026-55087","title":"Etherpad is a real-time collaborative editor","summary":"Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad uses the attacker-controlled x-proxy-path request header in src/node/hooks/express/admin.ts when substituting paths into HTML, JavaScript, and CSS under /admi…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-79","CWE-444","CWE-601"],"vendor":"ep_etherpad-lite","product":"ep_etherpad-lite","affected":["ep_etherpad-lite >= 2.1.0, <= 3.0.0"],"patched":["ep_etherpad-lite 3.1.0"],"published":"2026-08-19","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:15:59.613","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55087","references":[{"url":"https://github.com/ether/etherpad/commit/8c6104c5d5daf41f0d454acc04d42dffa0e0d996","label":"security-advisories@github.com"},{"url":"https://github.com/ether/etherpad/pull/7784","label":"security-advisories@github.com"},{"url":"https://github.com/ether/etherpad/security/advisories/GHSA-fjgc-3mj7-8rg8","label":"security-advisories@github.com"},{"url":"https://github.com/ether/etherpad/tree/3.1.0","label":"security-advisories@github.com"},{"url":"https://github.com/ether/etherpad/pull/6399"},{"url":"https://github.com/ether/etherpad/pull/7710"},{"url":"https://github.com/ether/etherpad/commit/451bd9c3ebb0dded99dd0ff21811ee00e0940c29"},{"url":"https://github.com/ether/etherpad/commit/63e9b2d4eb303cd341022591bdf9484584db36e3"},{"url":"https://github.com/advisories/GHSA-fjgc-3mj7-8rg8"}],"tags":["nvd","exploit-available","ghsa","npm"],"epss":0.00523,"epssPercentile":0.4337,"exploits":{"nuclei":["CVE-2026-55087"],"checkedAt":"2026-09-23T07:14:20.857Z"},"exploitAvailable":true,"aliases":["GHSA-fjgc-3mj7-8rg8"],"ecosystem":"npm","ingestedAt":"2026-08-13T14:03:33.664Z","slug":"CVE-2026-55087","body":"## Overview\n\nEtherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad uses the attacker-controlled x-proxy-path request header in src/node/hooks/express/admin.ts when substituting paths into HTML, JavaScript, and CSS under /admin without sanitization, Vary: x-proxy-path, or Cache-Control: private, no-store. A shared proxy or CDN can cache the resulting response and serve attacker-injected script to an administrator. In src/node/hooks/express/specialpages.ts, version 3.0.0 also accepts a protocol-relative x-proxy-path value when constructing the /p/:pad/timeslider redirect, allowing redirection to an attacker-controlled host. The issues are exploitable when the deployment permits client-supplied x-proxy-path headers to reach Etherpad. This issue is fixed in version 3.1.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-55087)\n\nAffected packages:\n\n- `ep_etherpad-lite >= 2.1.0, <= 3.0.0`\n\nPatched in:\n\n- `ep_etherpad-lite 3.1.0`\n\nSource: https://github.com/advisories/GHSA-fjgc-3mj7-8rg8","depth":"twilight","depthScore":46,"depthScoreParts":{"impact":33.6,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":5348,"id":"CVE-2026-55087","ts":1788887269546,"field":"exploit_available","old":"false","new":"true"},{"seq":4231,"id":"CVE-2026-55087","ts":1788886384518,"field":"exploit_available","old":"true","new":"false"},{"seq":2987,"id":"CVE-2026-55087","ts":1788883048209,"field":"exploit_available","old":"false","new":"true"},{"seq":2016,"id":"CVE-2026-55087","ts":1788882452621,"field":"exploit_available","old":"true","new":"false"},{"seq":1092,"id":"CVE-2026-55087","ts":1788881889243,"field":"exploit_available","old":"false","new":"true"}]}