CVE-2026-55087: Etherpad Lite cache-poisoning XSS and open redirect via x-proxy-path header

CVE-2026-55087 · Severity: medium · CVSS 6.1 · Published 2026-08-13

Etherpad is a collaborative real-time text editor that supports deployment behind reverse proxies. The application failed to properly sanitize the `x-proxy-path` HTTP header, allowing attackers to inject malicious scripts into admin interface resources or craft phishing redirects. When cached by a CDN or proxy, poisoned responses could affect multiple administrators, leading to account compromise and data theft.

Technologies: ep_etherpad-lite (npm). Vendors: npm.

Quick answers

Is CVE-2026-55087 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55087 being exploited in the wild.
How severe is CVE-2026-55087?
Medium severity, with a CVSS score of 6.1, published 13 August 2026.
Which products and versions are affected?
Etherpad Lite >=2.1.0, <=3.0.0; ep_etherpad-lite (npm) >= 2.1.0, <= 3.0.0, SEMVER:introduced=2.1.0,fixed=3.1.0.
Is there a fix for CVE-2026-55087?
Yes. ep_etherpad-lite (npm): upgrade to 3.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55087 attacked?
It is attacked over the network.
Am I affected by CVE-2026-55087?
Check whether you run Etherpad Lite or ep_etherpad-lite (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • ep_etherpad-lite (npm): upgrade to 3.1.0 or later
    npm install ep_etherpad-lite@3.1.0

Technical details

The vulnerability comprises two related issues in header handling. Issue 3a: the admin static handler (`src/node/hooks/express/admin.ts`) read the `x-proxy-path` header and directly interpolated it into HTML/JS/CSS responses using `String.prototype.replaceAll()` without sanitization or cache-control headers. This allowed reflected XSS, and worse, cache-poisoning XSS when a CDN cached the response by URL alone. Issue 3b: the `/p/:pad/timeslider` redirect endpoint in `src/node/hooks/express/specialpages.ts` concatenated an insufficiently sanitized proxy path into the `Location` header, producing protocol-relative URLs (`//evil.example/p/<pad>`) exploitable for phishing. Both issues require the untrusted header to reach Etherpad; hardened reverse-proxy deployments that strip the header are unaffected. The fix introduces centralized sanitization that blocks `//` prefixes, rejects path traversal, and adds `Vary: x-proxy-path` and `Cache-Control: private, no-store` headers to prevent cache collapse.

Affected products

  • Ether ep_etherpad-lite >=2.1.0, <=3.0.0

Identifiers

  • CVE-2026-55087
  • GHSA-fjgc-3mj7-8rg8

Timeline

  • 2026-06-10: disclosed
  • 2026-03-01: patched: Fix committed as 8c6104c, shipped in v3.1.0
  • 2024-05-22: other: Vulnerable code (Issue 3a) introduced in v2.1.0
  • 2026-01-01: other: Vulnerable code (Issue 3b) introduced in v3.0.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.