DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

GHSA-92HR-GMR6-H8CP: GHSA-92HR-GMR6-H8CP: Cryptographic Weaknesses, Parameter Pollution, Path Traversal, and Timing Flaws in Etherpad

#security #cve #cybersecurity #ghsa

GHSA-92HR-GMR6-H8CP: Cryptographic Weaknesses, Parameter Pollution, Path Traversal, and Timing Flaws in Etherpad

Vulnerability ID: GHSA-92HR-GMR6-H8CP
CVSS Score: 7.5
Published: 2026-08-17

A collection of multiple security issues in Etherpad before version 3.3.0, involving weak token generation, timing side channels, API parameter pollution, path traversal, and file-system path disclosure.

TL;DR

Etherpad deployments prior to version 3.3.0 are subject to token forecasting, login timing attacks, parameter pollution, path traversal via local plugins, and administrative file server error leaks.

Technical Details

  • Primary CWE ID: CWE-330
  • Secondary CWE IDs: CWE-208, CWE-307, CWE-235, CWE-22, CWE-209
  • Attack Vector: Network / Local (varies by component)
  • CVSS Score: N/A
  • Exploit Status: None (No active public exploits)
  • KEV Status: Not Listed
  • Patched Version: 3.3.0

Affected Systems

  • Etherpad Lite instances running versions prior to 3.3.0
  • etherpad-lite: < 3.3.0 (Fixed in: 3.3.0)

Code Analysis

Commit: 7ea9970

Etherpad addressed weak token RNG, login timing, plugin path handling, API request handling

Changes in src/static/js/pad_utils.ts, src/node/security/OAuth2Provider.ts, src/node/handler/RestAPI.ts, src/static/js/pluginfw/LinkInstaller.ts, src/node/hooks/express/admin.ts
Enter fullscreen mode Exit fullscreen mode

Mitigation Strategies

  • Upgrade Etherpad to version 3.3.0 or higher.
  • Implement network-level headers filtering or reverse proxy protections to block parameter pollution.
  • Restrict plugin install permissions to minimize risk of local path traversal.

Remediation Steps:

  1. Identify current Etherpad Lite installation version.
  2. Download and apply Etherpad version 3.3.0 or configure the updater.
  3. Audit standard output/error redirection settings to prevent system path leaks.
  4. Configure API route limitations and verify proxy headers configuration.

References

Read the full report for GHSA-92HR-GMR6-H8CP on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)