MEDIUM 6.1 GitHub
CVE-2026-55087
ep_etherpad-lite: Cache-poisoning Cross-site Scripting and Open Redirect via x-proxy-path Header
# GHSA-03 — `x-proxy-path` header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (open-redirect)
**Severity:** Medium
**CVSS v3.1 vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
**CVSS suggested base score:** ~6.1 — Medium
*(Re-validate in the first.gov calculator before filing. Score depends heavily on whether you assume a cooperative cache exists in front of the deployment — single-origin admin-only ops with no shared cache push toward 4.x; ca
Affected Products
- npm/ep_etherpad-lite >= 2.1.0, <= 3.0.0
References
- https://github.com/advisories/GHSA-fjgc-3mj7-8rg8
- https://github.com/ether/etherpad/security/advisories/GHSA-fjgc-3mj7-8rg8
- https://github.com/ether/etherpad/pull/6399
- https://github.com/ether/etherpad/pull/7710
This medium severity vulnerability with a CVSS score of 6.1 was published on 2026-08-13 via GitHub. Affected: npm/ep_etherpad-lite >= 2.1.0, <= 3.0.0.
vulnfeed aggregates 10617 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.