CVE-2026-55087

Received Received - Intake

HTTP Response Injection in Etherpad Admin Interface

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description

Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad uses the attacker-controlled x-proxy-path request header in src/node/hooks/express/admin.ts when substituting paths into HTML, JavaScript, and CSS under /admin without sanitization, Vary: x-proxy-path, or Cache-Control: private, no-store. A shared proxy or CDN can cache the resulting response and serve attacker-injected script to an administrator. In src/node/hooks/express/specialpages.ts, version 3.0.0 also accepts a protocol-relative x-proxy-path value when constructing the /p/:pad/timeslider redirect, allowing redirection to an attacker-controlled host. The issues are exploitable when the deployment permits client-supplied x-proxy-path headers to reach Etherpad. This issue is fixed in version 3.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-55087

EUVD

EUVD-2026-62721

Affected Vendors & Products

Vendor	Product	Version / Range
ether	etherpad	From 2.1.0 (inc) to 3.1.0 (exc)
ether	etherpad	3.1.0
ether	etherpad	3.0.2
ether	etherpad	From 2.1.0 (inc) to 3.0.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-601	The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
CWE-444	The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

Etherpad versions 2.1.0 to 3.0.0 improperly handle the x-proxy-path HTTP header, allowing cache-poisoning cross-site scripting (XSS) in the admin interface and open redirects. The header is reflected into admin files without sanitization, enabling reflected XSS if an admin visits a malicious URL. Shared caches like CDNs can store poisoned responses, spreading the attack. A protocol-relative x-proxy-path value can also redirect users to attacker-controlled hosts.

Detection Guidance

Check if your Etherpad version is below 3.1.0 by running: curl -s https://your-etherpad-instance.com | grep -i version. If the version is 2.1.0 to 3.0.0, the system is vulnerable.

Inspect HTTP headers for x-proxy-path in requests to /admin or /p/:pad/timeslider endpoints using browser dev tools or curl -I https://your-etherpad-instance.com/admin.

Impact Analysis

An attacker could inject malicious scripts into admin interfaces via XSS, stealing session cookies or sensitive data. If a shared cache is used, the attack becomes persistent, affecting multiple users. Open redirects could trick users into visiting phishing sites or malicious domains.

Compliance Impact

This vulnerability could lead to unauthorized access to admin interfaces, compromising user data and violating GDPR's integrity and confidentiality requirements. For HIPAA, it may expose protected health information if admin sessions are hijacked. Compliance depends on mitigating the risk through patching or configuration changes.

Mitigation Strategies

Upgrade Etherpad to version 3.1.0 or later immediately. If upgrading is not possible, configure your reverse proxy to strip the x-proxy-path header before it reaches Etherpad.

Disable the legacy /p/:pad/timeslider endpoint if not needed. Ensure cache-control headers are set to prevent caching of admin responses.

Hi! I’m here to help you understand CVE-2026-55087. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70