ether/etherpad Security Advisories | GitStock

high2026-08-17

Etherpad has stored XSS in HTML export via unescaped attribute-pool values

GHSA-2jp7-wwpg-3p9w · CVE-2026-55090

medium2026-08-17

Etherpad addressed weak token RNG, login timing, plugin path handling, API request handling

GHSA-92hr-gmr6-h8cp

medium2026-08-13

ep_etherpad-lite: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token

GHSA-vqfp-p66c-xrp9 · CVE-2026-55088

medium2026-08-13

ep_etherpad-lite: Import/export uses Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwrite

GHSA-2jwf-f4xq-f24h · CVE-2026-55086

medium2026-08-13

ep_etherpad-lite: Cache-poisoning Cross-site Scripting and Open Redirect via x-proxy-path Header

GHSA-fjgc-3mj7-8rg8 · CVE-2026-55087