CVE-2018-9327

Severity: high (CVSS 8.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-04-07 · updated 2026-06-17
Weakness: CWE-20

Description

Etherpad 1.5.x and 1.6.x before 1.6.4 allows an attacker to execute arbitrary code on the server. The instance has to be configured to use a document database (DirtyDB, CouchDB, MongoDB, or RethinkDB).

Affected products

etherpad-lite: from 1.5.0 through 1.5.7; from 1.6.0 before 1.6.4 — fixed in 1.6.4

How to fix

Upgrade to a fixed version: etherpad-lite 1.6.4. Check the vendor advisory for mitigations.

References

http://blog.etherpad.org/2018/04/07/important-release-1-6-4/
http://blog.etherpad.org/2018/04/07/important-release-1-6-4/

Get alerted when CVE-2018-9327 or the next vulnerability affects your stack