CVE-2026-55086

Received Received - Intake

Path Traversal in Etherpad Real-Time Editor

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description

Etherpad is a real-time collaborative editor. Prior to 3.1.0, src/node/handler/ImportHandler.ts and src/node/handler/ExportHandler.ts derive temporary filenames from Math.random() and place them in os.tmpdir(). On a host with a shared world-writable temporary directory, a local unprivileged attacker who predicts a filename can precreate a symbolic link to a file writable by the Etherpad process. Subsequent import or export operations can follow the link through fs.writeFile, fs.rename, or document-conversion output and overwrite the target with partially attacker-controlled content. This issue is fixed in version 3.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-55086

EUVD

EUVD-2026-62741

Affected Vendors & Products

Vendor	Product	Version / Range
etherpad	etherpad	3.1.0
etherpad	ep_etherpad_lite	to 3.0.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-377	Creating and using insecure temporary files can leave application and system data vulnerable to attack.
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

Executive Summary

CVE-2026-55086 is a file overwrite vulnerability in Etherpad, a real-time collaborative editor. It occurs because temporary filenames for import/export operations are generated using Math.random(), which is predictable. These files are stored in a shared /tmp directory, allowing local attackers to precreate symbolic links to sensitive files. When Etherpad writes to these predicted paths, it overwrites the targeted files with attacker-controlled content.

Detection Guidance

To detect this vulnerability, check if your Etherpad instance is running a version prior to 3.1.0. Use the command: npm list ep_etherpad-lite or check the version in the package.json file. Additionally, inspect if the /tmp directory is world-writable and shared among users.

Impact Analysis

This vulnerability allows local unprivileged attackers to overwrite sensitive files on the system where Etherpad runs. If Etherpad has write access to critical files, attackers could modify configurations, inject malicious code, or corrupt data. The impact is higher in multi-tenant environments where multiple users share the same host.

Compliance Impact

This vulnerability could lead to unauthorized file modifications, potentially violating data integrity and confidentiality requirements under GDPR and HIPAA. If sensitive data files are overwritten, it may result in compliance breaches, unauthorized access, or data corruption, depending on the affected files and system configuration.

Mitigation Strategies

Upgrade Etherpad to version 3.1.0 or later. If upgrading is not immediately possible, set a private TMPDIR environment variable, run Etherpad in a container with a private /tmp directory, or ensure the process does not run as root.

Hi! I’m here to help you understand CVE-2026-55086. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70