MEDIUM 4.2 GitHub
CVE-2026-55086
ep_etherpad-lite: Import/export uses Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwrite
## Description
`src/node/handler/ImportHandler.ts` and `src/node/handler/ExportHandler.ts` both compute their temporary working-file paths as:
```ts
const randNum = Math.floor(Math.random() * 0xFFFFFFFF);
const srcFile = `${os.tmpdir()}/etherpad_export_${randNum}.html`;
const destFile = `${os.tmpdir()}/etherpad_export_${randNum}.${type}`;
```
Two flaws compound:
1. **`Math.random()` is not crypto-secure.** It yields at most ~32 bits of entropy and is **predictable across calls within the sam
Affected Products
- npm/ep_etherpad-lite <= 3.0.0
References
- https://github.com/advisories/GHSA-2jwf-f4xq-f24h
- https://github.com/ether/etherpad/security/advisories/GHSA-2jwf-f4xq-f24h
- https://github.com/ether/etherpad/pull/7784
- https://github.com/ether/etherpad/commit/8c6104c5d5daf41f0d454acc04d42dffa0e0d996
This medium severity vulnerability with a CVSS score of 4.2 was published on 2026-08-13 via GitHub. Affected: npm/ep_etherpad-lite <= 3.0.0.
vulnfeed aggregates 10617 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.