Junglewise Threat Intelligence

CVE-2026-55087: Etherpad Lite cache-poisoning XSS and open redirect via x-proxy-path header

CVE-2026-55087 · Severity: medium · CVSS 6.1 · Published 2026-08-13

Executive brief

Etherpad is a collaborative real-time text editor that supports deployment behind reverse proxies. The application failed to properly sanitize the `x-proxy-path` HTTP header, allowing attackers to inject malicious scripts into admin interface resources or craft phishing redirects. When cached by a CDN or proxy, poisoned responses could affect multiple administrators, leading to account compromise and data theft.

Technical details

The vulnerability comprises two related issues in header handling. Issue 3a: the admin static handler (`src/node/hooks/express/admin.ts`) read the `x-proxy-path` header and directly interpolated it into HTML/JS/CSS responses using `String.prototype.replaceAll()` without sanitization or cache-control headers. This allowed reflected XSS, and worse, cache-poisoning XSS when a CDN cached the response by URL alone. Issue 3b: the `/p/:pad/timeslider` redirect endpoint in `src/node/hooks/express/specialpages.ts` concatenated an insufficiently sanitized proxy path into the `Location` header, producing protocol-relative URLs (`//evil.example/p/<pad>`) exploitable for phishing. Both issues require the untrusted header to reach Etherpad; hardened reverse-proxy deployments that strip the header are unaffected. The fix introduces centralized sanitization that blocks `//` prefixes, rejects path traversal, and adds `Vary: x-proxy-path` and `Cache-Control: private, no-store` headers to prevent cache collapse.

Affected products

  • Ether ep_etherpad-lite >=2.1.0, <=3.0.0

Timeline

  • 2026-06-10: disclosed
  • 2026-03-01: patched: Fix committed as 8c6104c, shipped in v3.1.0
  • 2024-05-22: other: Vulnerable code (Issue 3a) introduced in v2.1.0
  • 2026-01-01: other: Vulnerable code (Issue 3b) introduced in v3.0.0

References

Related threats