Path traversal in Etherpad - CVE-2026-114516
Published: November 4, 2026
Vulnerability details
The vulnerability allows a remote attacker to read arbitrary files accessible to the Etherpad process and potentially execute arbitrary code, compromising the server's confidentiality, integrity, and availability.
The vulnerability exists due to path traversal in Etherpad's /static/* handler in src/node/utils/Minify.ts when processing plugin asset paths: backslashes are converted to forward slashes after pathname validation, introducing unchecked traversal sequences on POSIX systems. A remote attacker can send a crafted request such as GET /static/plugins/ep_etherpad-lite/static/..%5C..%5C..%5C..%5C..%5C..%5C..%5Cetc/passwd to read files outside the static directory; disclosed administrator credentials can then provide an administrator session and enable arbitrary code execution through installation of an attacker-controlled plugin.