CVE-2026-55087
Mediumep_etherpad-lite: Cache-poisoning Cross-site Scripting and Open Redirect via x-proxy-path Header
Published Aug 13, 2026 · Updated Sep 11, 2026 · Also known as GHSA-fjgc-3mj7-8rg8
Key Facts
Routine patching- CVE-2026-55087 is a medium-severity vulnerability (CVSS 6.1 v3.1) affecting ep_etherpad-lite (npm), etherpad.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 0.6% probability of exploitation in the next 30 days.
- Fixed versions are available, including ep_etherpad-lite 3.1.0.
- Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.
CVSS v3.1
6.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS (30-day exploit likelihood)
0.6%
Higher than 46.4% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2026-55087 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad uses the attacker-controlled x-proxy-path request header in src/node/hooks/express/admin.ts when substituting paths into HTML, JavaScript, and CSS under /admin without sanitization, Vary: x-proxy-path, or Cache-Control: private, no-store. A shared proxy or CDN can cache the resulting response and serve attacker-injected script to an administrator. In src/node/hooks/express/specialpages.ts, version 3.0.0 also accepts a protocol-relative x-proxy-path value when constructing the /p/:pad/timeslider redirect, allowing redirection to an attacker-controlled host. The issues are exploitable when the deployment permits client-supplied x-proxy-path headers to reach Etherpad. This issue is fixed in version 3.1.0.
Affected Products
2 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| ep_etherpad-litenpm | >= 2.1.0 | 3.1.0 |
| etherpad | >= >= 2.1.0, < 3.1.0 | n/a |
Patched Releases
ep_etherpad-lite
3.1.0
Timeline
Publicly disclosed
Aug 13, 2026
Last updated
Sep 11, 2026
Weakness Type
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
- CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
References
- advisoryGHSA advisory
- advisoryhttps://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55087.json
- advisoryhttps://github.com/ether/etherpad/security/advisories
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2026-55087
- advisoryUSOM advisory
FAQ
Common Questions.
Etherpad is a real-time collaborative editor.
Affected: ep_etherpad-lite (npm) versions >= 2.1.0; etherpad versions >= >= 2.1.0, < 3.1.0. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including ep_etherpad-lite 3.1.0.
Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.
Is CVE-2026-55087 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo