Please email contact@etherpad.org to report security related issues.
Repository navigation
Security: ether/etherpad
Security
SECURITY.md
-
Etherpad plugin-uninstall arbitrary directory deletion (GHSA-92hr-gmr6-h8cp incomplete fix)GHSA-g9xm-3pqr-wcph published
Oct 18, 2026 by JohnMcLearModerate -
OIDC: a user whose sub matches a configured client_id is treated as client_credentials and gets admin API accessGHSA-38vj-95q4-gwvx published
Oct 11, 2026 by JohnMcLearModerate -
Forged tag: class token via a space in a start attribute gives stored XSS in appendSpanGHSA-4mx2-rqx5-2pp6 published
Oct 5, 2026 by JohnMcLearHigh -
OIDC interactive login accepts the literal "undefined"/"null" as the password for accounts that have noneGHSA-62cj-9j72-mfrh published
Sep 21, 2026 by JohnMcLearModerate -
Stored XSS in HTML diff export via unescaped author color values in getHTMLFromAtextGHSA-6vx2-3gwr-958v published
Sep 17, 2026 by JohnMcLearModerate -
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in etherpad-liteGHSA-f7h5-v9hm-548j published
Jun 10, 2026 by JohnMcLearCritical -
Import/export use Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwriteGHSA-2jwf-f4xq-f24h published
Jun 10, 2026 by JohnMcLearModerate -
x-proxy-path header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (open-redirect)GHSA-fjgc-3mj7-8rg8 published
Jun 10, 2026 by JohnMcLearModerate -
Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author tokenGHSA-vqfp-p66c-xrp9 published
Jun 10, 2026 by JohnMcLearModerate -
JWT `admin` claim presence-only check lets non-admin OAuth users invoke every Etherpad HTTP API endpointGHSA-qfmh-fph3-mw8q published
Jun 10, 2026 by JohnMcLearCritical
Learn more about advisories related to ether/etherpad in the GitHub Advisory Database