CVE-2026-55086

Name of the Vulnerable Software and Affected Versions Etherpad versions prior to 3.1.0

Description Files src/node/handler/ImportHandler.ts and src/node/handler/ExportHandler.ts generate temporary filenames using Math.random(), which is not cryptographically secure and predictable across calls within the same Node process. These files are placed in os.tmpdir(), which is often a shared world-writable directory like /tmp on Linux. A local unprivileged attacker who predicts a filename can create a symbolic link at that path pointing to a file writable by the Etherpad process. When the software performs import or export operations, it may follow the link via fs.writeFile, fs.rename, or document-conversion output, allowing the attacker to overwrite the target file with partially controlled content. This is particularly critical if the Etherpad process runs with high privileges, such as root.

Recommendations Update Etherpad to version 3.1.0 or later. Run Etherpad in a container with a private /tmp directory. Ensure the Etherpad process does not run as root and only has write access to its own data directory. Set the TMPDIR environment variable to a directory private to Etherpad.