SB20261105114 - Multiple vulnerabilities in Etherpad
Published: November 5, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Open redirect (CVE-ID: N/A)
CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to redirect an Etherpad user to an attacker-controlled HTTP or HTTPS origin through the timeslider's ordinary-looking "Return to pad" toolbar button, enabling phishing with an attacker-chosen landing path such as /p/login. Exploitation requires the victim to follow an attacker-controlled link into the timeslider and then click the button. This is a client-side open redirect, not script execution: the browser-generated referrer does not permit JavaScript or data URL destinations.
The vulnerability exists due to insufficient validation of document.referrer in the timeslider_returnToPad command in src/static/js/pad_editbar.ts. The handler checks only that the referrer is nonempty and that the character immediately before its last slash is p, then assigns the entire referrer to document.location. It neither parses the URL nor checks its origin or an allow-list. Consequently, external URLs with matching paths, including /p/ and /p/login, are accepted. A remote attacker can place a link on a page they control at a matching path, configure a page-level or per-link referrer policy of unsafe-url, and entice a victim to open the timeslider as a top-level page and click "Return to pad". Preserving the full referrer path is necessary because the default strict-origin-when-cross-origin policy reduces a cross-origin referrer to its origin, which fails the check.
The affected npm package is ep_etherpad-lite. In the documented configuration, the entry point requires /p/:pad/timeslider?embed=1; without embed=1, the direct timeslider request redirects back to the pad. A top-level visit retains the visible toolbar, whereas normal in-pad history mode hides it when the embedded-history frame also has iframe-mode. An empty referrer or a referrer that fails the character check instead causes navigation to the pad URL derived from the current location. The vulnerable navigation occurs in the browser after a toolbar click, rather than through a server-issued redirect. Successful redirects were demonstrated between distinct localhost origins using page-level and per-link referrer policies; public deployments, other browser versions, and an HTTPS target with an HTTP attacker page were not tested.
Remediation
Install update from vendor's website.