etherpad
v3.3.17Etherpad: A modern really-real-time collaborative document editor.
- Maintenance
- Active303 commits in 3 months · bus factor 2
- License
- Apache-2.0Permissive · OSI-approved
- Security
- 24 advisories4 critical, 4 high, 14 medium, 2 low
- Supported versions
- No scheduleendoflife.date does not track this project
18.6k stars · 3.1k forks · 16 open issues · last release 3 days ago · data checked 34 minutes ago
Security advisories
All advisories on GitHubThe 24 most recent advisories published by the maintainers: 4 critical, 4 high, 14 medium, 2 low. Check the patched version against the one you run.
- mediumGHSA-w4w9-j4c3-hjf6Nov 13, 2026Unauthenticated author name up to ~1 MB is stored and rebroadcast to every pad client
- Affected
- < 3.3.17
- Patched in
- 3.3.17
- highGHSA-c36r-65p6-q3m9Nov 7, 2026Incomplete fix for GHSA-6mcx-x5h6-rpw2: cross-pad race still exposes chat and revision history of unauthorized pads (chat read/write, changeset history, saved revisions)
- Affected
- < 3.3.16
- Patched in
- 3.3.16
- mediumGHSA-qq7c-m9pc-7q7vNov 2, 2026.etherpad import lets any pad writer forge pad ownership, publicStatus and the deletion token
- Affected
- <= 3.3.12
- Patched in
- 3.3.13
- lowGHSA-35rj-7vrx-29wqOct 28, 2026Open redirect in timeslider "Return to pad": unvalidated document.referrer allows redirect to attacker origin
- Affected
- <= 3.3.11
- Patched in
- 3.3.12
- mediumGHSA-x4mj-5635-3fq9Oct 27, 2026Etherpad: SSRF via image-src filter bypass in DOCX/PDF/ODT export pipeline
- Affected
- <= 3.3.5
- Patched in
- 3.3.6
- highGHSA-73h9-c5xp-gfg4Oct 27, 2026Etherpad does not regenerate the session ID on authentication, enabling SSO session fixation
- Affected
- <= 3.3.2
- Patched in
- 3.3.3
- lowGHSA-wg58-mhwv-35pqOct 27, 2026copyPad/movePad destinationID allows the ueberdb key delimiter ':' , bypassing the force=false overwrite guard and corrupting another pad's revision records
- Affected
- <= 3.3.2
- Patched in
- 3.3.3
- mediumGHSA-6mcx-x5h6-rpw2Oct 27, 2026PadMessageHandler TOCTOU: same-socket CLIENT_READY pad-swap redirects a queued USER_CHANGES onto a read-only/unauthorized pad (cross-pad write)
- Affected
- <= 3.3.2
- Patched in
- 3.3.3
- mediumGHSA-pp5v-mvwg-76mpOct 27, 2026Embedded OIDC provider: hardcoded cookie signing key allows forged provider cookies, and clientBasedCORS reflects arbitrary origins
- Affected
- <= 3.3.2
- Patched in
- 3.3.3
- criticalCVE-2026-114516Oct 27, 2026Pre-auth arbitrary file read
- Affected
- 1.8.14 - 3.3.2
- Patched in
- 3.3.3
- mediumGHSA-746x-9w89-7xv6Oct 24, 2026Clients without an author token all share one author (token2author:null)
- Affected
- <= 3.3.10
- Patched in
- 3.3.11
- mediumGHSA-g9xm-3pqr-wcphOct 18, 2026Etherpad plugin-uninstall arbitrary directory deletion (GHSA-92hr-gmr6-h8cp incomplete fix)
- Affected
- >= 2.0.0, <= 3.3.8
- Patched in
- 3.3.9
- mediumGHSA-38vj-95q4-gwvxOct 11, 2026OIDC: a user whose sub matches a configured client_id is treated as client_credentials and gets admin API access
- Affected
- <= 3.3.7
- Patched in
- 3.3.8
- highGHSA-4mx2-rqx5-2pp6Oct 5, 2026Forged tag: class token via a space in a start attribute gives stored XSS in appendSpan
- Affected
- <= 3.3.6
- Patched in
- 3.3.7
- mediumGHSA-62cj-9j72-mfrhSep 21, 2026OIDC interactive login accepts the literal "undefined"/"null" as the password for accounts that have none
- Affected
- <= 3.3.5
- Patched in
- 3.3.6
- mediumGHSA-6vx2-3gwr-958vSep 17, 2026Stored XSS in HTML diff export via unescaped author color values in getHTMLFromAtext
- Affected
- <= 3.3.3
- Patched in
- 3.3.4
- highCVE-2026-55090Jun 10, 2026Stored XSS in HTML export via unescaped attribute-pool values
- Affected
- <= 3.2.0
- mediumGHSA-92hr-gmr6-h8cpJun 10, 2026Hardening: weak token RNG, login timing, plugin path handling, API request handling
- Affected
- <= 3.2.0
- criticalCVE-2026-55089Jun 10, 2026JWT `admin` claim presence-only check lets non-admin OAuth users invoke every Etherpad HTTP API endpoint
- Affected
- >= 2.1.0, <= 3.0.0
- Patched in
- >= 3.1.0
- mediumCVE-2026-55088Jun 10, 2026Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token
- Affected
- >= 2.6.0, <= 3.0.0
- Patched in
- >= 3.1.0
- mediumCVE-2026-55087Jun 10, 2026x-proxy-path header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (open-redirect)
- Affected
- >= 2.1.0, <= 3.0.0
- Patched in
- >= 3.1.0
- mediumCVE-2026-55086Jun 10, 2026Import/export use Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwrite
- Affected
- <= 3.0.0
- Patched in
- >= 3.1.0
- criticalCVE-2026-55085Jun 10, 2026Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in etherpad-lite
- Affected
- <= 3.3.0
- Patched in
- 3.3.1
- criticalCVE-2021-43802Dec 9, 2021Admin privilege escalation and arbitrary code execution via malicious *.etherpad imports
- Affected
- < 1.8.16
- Patched in
- 1.8.16