SB2026110431 - Path traversal in Etherpad
Published: November 4, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Path traversal (CVE-ID: CVE-2026-114516)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to read arbitrary files accessible to the Etherpad process and potentially execute arbitrary code, compromising the server's confidentiality, integrity, and availability.
The vulnerability exists due to path traversal in Etherpad's /static/* handler in src/node/utils/Minify.ts when processing plugin asset paths: backslashes are converted to forward slashes after pathname validation, introducing unchecked traversal sequences on POSIX systems. A remote attacker can send a crafted request such as GET /static/plugins/ep_etherpad-lite/static/..%5C..%5C..%5C..%5C..%5C..%5C..%5Cetc/passwd to read files outside the static directory; disclosed administrator credentials can then provide an administrator session and enable arbitrary code execution through installation of an attacker-controlled plugin.
Remediation
Install update from vendor's website.