Ether Etherpad
6 CVEs affecting Ether Etherpad. Latest disclosed: 2026-08-19. Critical: 2, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-55089 | Critical | 9.9 | 2026-08-19 | Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad's src/node/handler/APIHandler.ts authorizes requests to /api/2/* in the authoriz… |
CVE-2026-55085 | Critical | 9.6 | 2026-08-19 | Etherpad is a real-time collaborative editor. Prior to 3.3.1, result.appendSpan in src/static/js/domline.ts interpolates the start attribute of a numbered list… |
CVE-2026-55088 | Medium | 6.8 | 2026-08-19 | Etherpad is a real-time collaborative editor. From 2.6.0 until 3.1.0, Etherpad's src/node/hooks/express/tokenTransfer.ts uses POST /tokenTransfer to store an a… |
CVE-2026-55087 | Medium | 6.1 | 2026-08-19 | Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad uses the attacker-controlled x-proxy-path request header in src/node/hooks/expre… |
CVE-2026-55086 | Medium | 4.2 | 2026-08-19 | Etherpad is a real-time collaborative editor. Prior to 3.1.0, src/node/handler/ImportHandler.ts and src/node/handler/ExportHandler.ts derive temporary filename… |
CVE-2026-55090 | | 2026-08-19 | Etherpad is a real-time collaborative editor. Prior to 3.3.0, getHTMLFromAtext in src/node/utils/ExportHtml.ts interpolates values from the exportHtmlAdditiona… |