# CVE-2026-55087: Etherpad Lite cache-poisoning XSS and open redirect via x-proxy-path header

Source: https://junglewise.ai/threats/cve-2026-55087-etherpad-lite-cache-poisoning-xss-and-open-redirect-via-x-proxy  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-13. Updated: 2026-09-24  
License: CC BY 4.0 with a link back

CVE-2026-55087 · Severity: medium · CVSS 6.1 · Published 2026-08-13

Etherpad is a collaborative real-time text editor that supports deployment behind reverse proxies. The application failed to properly sanitize the `x-proxy-path` HTTP header, allowing attackers to inject malicious scripts into admin interface resources or craft phishing redirects. When cached by a CDN or proxy, poisoned responses could affect multiple administrators, leading to account compromise and data theft.

Technologies: [ep_etherpad-lite (npm)](https://junglewise.ai/threats/technologies/ep-etherpad-lite). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-55087 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55087 being exploited in the wild.

**How severe is CVE-2026-55087?** Medium severity, with a CVSS score of 6.1, published 13 August 2026.

**Which products and versions are affected?** Etherpad Lite >=2.1.0, <=3.0.0; ep_etherpad-lite (npm) >= 2.1.0, <= 3.0.0, SEMVER:introduced=2.1.0,fixed=3.1.0.

**Is there a fix for CVE-2026-55087?** Yes. ep_etherpad-lite (npm): upgrade to 3.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55087 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-55087?** Check whether you run Etherpad Lite or ep_etherpad-lite (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- ep_etherpad-lite (npm): upgrade to 3.1.0 or later

  ```sh
  npm install ep_etherpad-lite@3.1.0
  ```


## Technical details

The vulnerability comprises two related issues in header handling. Issue 3a: the admin static handler (`src/node/hooks/express/admin.ts`) read the `x-proxy-path` header and directly interpolated it into HTML/JS/CSS responses using `String.prototype.replaceAll()` without sanitization or cache-control headers. This allowed reflected XSS, and worse, cache-poisoning XSS when a CDN cached the response by URL alone. Issue 3b: the `/p/:pad/timeslider` redirect endpoint in `src/node/hooks/express/specialpages.ts` concatenated an insufficiently sanitized proxy path into the `Location` header, producing protocol-relative URLs (`//evil.example/p/<pad>`) exploitable for phishing. Both issues require the untrusted header to reach Etherpad; hardened reverse-proxy deployments that strip the header are unaffected. The fix introduces centralized sanitization that blocks `//` prefixes, rejects path traversal, and adds `Vary: x-proxy-path` and `Cache-Control: private, no-store` headers to prevent cache collapse.

## Affected products

- Ether ep_etherpad-lite >=2.1.0, <=3.0.0

## Identifiers

- CVE-2026-55087
- GHSA-fjgc-3mj7-8rg8

## Timeline

- 2026-06-10: disclosed
- 2026-03-01: patched: Fix committed as 8c6104c, shipped in v3.1.0
- 2024-05-22: other: Vulnerable code (Issue 3a) introduced in v2.1.0
- 2026-01-01: other: Vulnerable code (Issue 3b) introduced in v3.0.0

## References

- [https://github.com/ether/etherpad/security/advisories/GHSA-fjgc-3mj7-8rg8](https://github.com/ether/etherpad/security/advisories/GHSA-fjgc-3mj7-8rg8)
- [https://github.com/ether/etherpad/pull/6399](https://github.com/ether/etherpad/pull/6399)
- [https://github.com/ether/etherpad/pull/7710](https://github.com/ether/etherpad/pull/7710)
- [https://github.com/ether/etherpad/pull/7784](https://github.com/ether/etherpad/pull/7784)
- [https://github.com/ether/etherpad/commit/451bd9c3ebb0dded99dd0ff21811ee00e0940c29](https://github.com/ether/etherpad/commit/451bd9c3ebb0dded99dd0ff21811ee00e0940c29)
- [https://github.com/ether/etherpad/commit/63e9b2d4eb303cd341022591bdf9484584db36e3](https://github.com/ether/etherpad/commit/63e9b2d4eb303cd341022591bdf9484584db36e3)

## Related threats

- [Etherpad stored XSS in HTML export via unescaped attribute-pool values](https://junglewise.ai/threats/cve-2026-55090-etherpad-stored-xss-in-html-export-via-unescaped-attribute-pool)
- [Etherpad multiple security hardening fixes](https://junglewise.ai/threats/etherpad-multiple-security-hardening-fixes-3a746766)
- [Etherpad replayable token-transfer endpoint with cleartext token exposure](https://junglewise.ai/threats/cve-2026-55088-etherpad-replayable-token-transfer-endpoint-with-cleartext-token)
- [Etherpad predictable temp file paths enable symlink-based file overwrite](https://junglewise.ai/threats/cve-2026-55086-etherpad-predictable-temp-file-paths-enable-symlink-based-file)
- [Etherpad Lite access restriction bypass in JSONP handling](https://junglewise.ai/threats/cve-2018-6835-etherpad-lite-access-restriction-bypass-in-jsonp-handling)