CVE-2026-55087

Name of the Vulnerable Software and Affected Versions Etherpad versions 2.1.0 through 3.0.0

Description Etherpad fails to properly sanitize the x-proxy-path request header, leading to two distinct issues when client-supplied headers reach the server. First, in src/node/hooks/express/admin.ts, the header is substituted into HTML, JavaScript, and CSS files under the /admin endpoint without sanitization or appropriate cache-control headers. This allows an attacker to perform Reflected Cross-Site Scripting (XSS) or Cache-Poisoning XSS, where a shared proxy or CDN caches a malicious response and serves it to administrators. Second, in src/node/hooks/express/specialpages.ts for version 3.0.0, the /p/:pad/timeslider endpoint accepts protocol-relative values in the x-proxy-path header, enabling an open redirect to an attacker-controlled host.

Recommendations Update Etherpad to version 3.1.0 or later. Configure the reverse proxy to strip or overwrite the x-proxy-path header from inbound client requests. As a temporary mitigation for the open redirect, disable the legacy direct-timeslider URL by using client-side routing to /p/:pad.