Please email contact@etherpad.org to report security related issues.
Repository navigation
Security: ether/etherpad
Security
SECURITY.md
-
Pre-auth arbitrary file readGHSA-mc8w-wjhw-45x5 published
Oct 27, 2026 by JohnMcLearCritical -
Embedded OIDC provider: hardcoded cookie signing key allows forged provider cookies, and clientBasedCORS reflects arbitrary originsGHSA-pp5v-mvwg-76mp published
Oct 27, 2026 by JohnMcLearModerate -
PadMessageHandler TOCTOU: same-socket CLIENT_READY pad-swap redirects a queued USER_CHANGES onto a read-only/unauthorized pad (cross-pad write)GHSA-6mcx-x5h6-rpw2 published
Oct 27, 2026 by JohnMcLearModerate -
Etherpad does not regenerate the session ID on authentication, enabling SSO session fixationGHSA-73h9-c5xp-gfg4 published
Oct 27, 2026 by JohnMcLearHigh -
copyPad/movePad destinationID allows the ueberdb key delimiter ':' , bypassing the force=false overwrite guard and corrupting another pad's revision recordsGHSA-wg58-mhwv-35pq published
Oct 27, 2026 by JohnMcLearLow -
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in etherpad-liteGHSA-f7h5-v9hm-548j published
Jun 10, 2026 by JohnMcLearCritical -
Import/export use Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwriteGHSA-2jwf-f4xq-f24h published
Jun 10, 2026 by JohnMcLearModerate -
x-proxy-path header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (open-redirect)GHSA-fjgc-3mj7-8rg8 published
Jun 10, 2026 by JohnMcLearModerate -
Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author tokenGHSA-vqfp-p66c-xrp9 published
Jun 10, 2026 by JohnMcLearModerate -
JWT `admin` claim presence-only check lets non-admin OAuth users invoke every Etherpad HTTP API endpointGHSA-qfmh-fph3-mw8q published
Jun 10, 2026 by JohnMcLearCritical
Learn more about advisories related to ether/etherpad in the GitHub Advisory Database