GHSA-92HR-GMR6-H8CP: Cryptographic Weaknesses, Parameter Pollution, Path Traversal, and Timing Flaws in Etherpad
Vulnerability ID: GHSA-92HR-GMR6-H8CP
CVSS Score: 7.5
Published: 2026-08-17
A collection of multiple security issues in Etherpad before version 3.3.0, involving weak token generation, timing side channels, API parameter pollution, path traversal, and file-system path disclosure.
TL;DR
Etherpad deployments prior to version 3.3.0 are subject to token forecasting, login timing attacks, parameter pollution, path traversal via local plugins, and administrative file server error leaks.
Technical Details
- Primary CWE ID: CWE-330
- Secondary CWE IDs: CWE-208, CWE-307, CWE-235, CWE-22, CWE-209
- Attack Vector: Network / Local (varies by component)
- CVSS Score: N/A
- Exploit Status: None (No active public exploits)
- KEV Status: Not Listed
- Patched Version: 3.3.0
Affected Systems
- Etherpad Lite instances running versions prior to 3.3.0
-
etherpad-lite: < 3.3.0 (Fixed in:
3.3.0)
Code Analysis
Commit: 7ea9970
Etherpad addressed weak token RNG, login timing, plugin path handling, API request handling
Changes in src/static/js/pad_utils.ts, src/node/security/OAuth2Provider.ts, src/node/handler/RestAPI.ts, src/static/js/pluginfw/LinkInstaller.ts, src/node/hooks/express/admin.ts
Mitigation Strategies
- Upgrade Etherpad to version 3.3.0 or higher.
- Implement network-level headers filtering or reverse proxy protections to block parameter pollution.
- Restrict plugin install permissions to minimize risk of local path traversal.
Remediation Steps:
- Identify current Etherpad Lite installation version.
- Download and apply Etherpad version 3.3.0 or configure the updater.
- Audit standard output/error redirection settings to prevent system path leaks.
- Configure API route limitations and verify proxy headers configuration.
References
Read the full report for GHSA-92HR-GMR6-H8CP on our website for more details including interactive diagrams and full exploit analysis.
