What’s Vulnerable › Products

etherpad vulnerabilities

6 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Check whether your etherpad version is affected

Latest etherpad vulnerabilities

• CVE-2026-55090 — Etherpad: Stored XSS in HTML export via unescaped attribute-pool values (CVSS 5.3)
• CVE-2026-55089 — Etherpad: JWT `admin` claim presence-only check lets non-admin OAuth users invoke every Etherpad HTTP API endpoint (CVSS 9.9)
• CVE-2026-55088 — Etherpad: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token (CVSS 6.8)
• CVE-2026-55087 — Etherpad: x-proxy-path header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (open-redirect) (CVSS 6.1)
• CVE-2026-55086 — Etherpad: Import/export use Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwrite (CVSS 4.2)
• CVE-2026-55085 — Etherpad: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in etherpad-lite (CVSS 9.6)