---
id: CVE-2026-55087
title: Etherpad is a real-time collaborative editor
summary: >-
  Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad
  uses the attacker-controlled x-proxy-path request header in
  src/node/hooks/express/admin.ts when substituting paths into HTML, JavaScript,
  and CSS under /admi…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
  - CWE-444
  - CWE-601
vendor: ep_etherpad-lite
product: ep_etherpad-lite
affected:
  - 'ep_etherpad-lite >= 2.1.0, <= 3.0.0'
patched:
  - ep_etherpad-lite 3.1.0
published: '2026-08-19'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:15:59.613'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-55087'
references:
  - url: >-
      https://github.com/ether/etherpad/commit/8c6104c5d5daf41f0d454acc04d42dffa0e0d996
    label: security-advisories@github.com
  - url: 'https://github.com/ether/etherpad/pull/7784'
    label: security-advisories@github.com
  - url: 'https://github.com/ether/etherpad/security/advisories/GHSA-fjgc-3mj7-8rg8'
    label: security-advisories@github.com
  - url: 'https://github.com/ether/etherpad/tree/3.1.0'
    label: security-advisories@github.com
  - url: 'https://github.com/ether/etherpad/pull/6399'
  - url: 'https://github.com/ether/etherpad/pull/7710'
  - url: >-
      https://github.com/ether/etherpad/commit/451bd9c3ebb0dded99dd0ff21811ee00e0940c29
  - url: >-
      https://github.com/ether/etherpad/commit/63e9b2d4eb303cd341022591bdf9484584db36e3
  - url: 'https://github.com/advisories/GHSA-fjgc-3mj7-8rg8'
tags:
  - nvd
  - exploit-available
  - ghsa
  - npm
epss: 0.00523
epssPercentile: 0.43394
exploits:
  nuclei:
    - CVE-2026-55087
  checkedAt: '2026-09-24T07:53:07.489Z'
exploitAvailable: true
aliases:
  - GHSA-fjgc-3mj7-8rg8
ecosystem: npm
ingestedAt: '2026-08-13T14:03:33.664Z'
---

## Overview

Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad uses the attacker-controlled x-proxy-path request header in src/node/hooks/express/admin.ts when substituting paths into HTML, JavaScript, and CSS under /admin without sanitization, Vary: x-proxy-path, or Cache-Control: private, no-store. A shared proxy or CDN can cache the resulting response and serve attacker-injected script to an administrator. In src/node/hooks/express/specialpages.ts, version 3.0.0 also accepts a protocol-relative x-proxy-path value when constructing the /p/:pad/timeslider redirect, allowing redirection to an attacker-controlled host. The issues are exploitable when the deployment permits client-supplied x-proxy-path headers to reach Etherpad. This issue is fixed in version 3.1.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-55087)

Affected packages:

- `ep_etherpad-lite >= 2.1.0, <= 3.0.0`

Patched in:

- `ep_etherpad-lite 3.1.0`

Source: https://github.com/advisories/GHSA-fjgc-3mj7-8rg8