Please email contact@etherpad.org to report security related issues.
Repository navigation
Security: ether/etherpad
Security
SECURITY.md
-
Open redirect in timeslider "Return to pad": unvalidated document.referrer allows redirect to attacker originGHSA-35rj-7vrx-29wq published
Oct 28, 2026 by JohnMcLearLow -
Clients without an author token all share one author (token2author:null)GHSA-746x-9w89-7xv6 published
Oct 24, 2026 by JohnMcLearModerate -
Etherpad plugin-uninstall arbitrary directory deletion (GHSA-92hr-gmr6-h8cp incomplete fix)GHSA-g9xm-3pqr-wcph published
Oct 18, 2026 by JohnMcLearModerate -
OIDC: a user whose sub matches a configured client_id is treated as client_credentials and gets admin API accessGHSA-38vj-95q4-gwvx published
Oct 11, 2026 by JohnMcLearModerate -
Forged tag: class token via a space in a start attribute gives stored XSS in appendSpanGHSA-4mx2-rqx5-2pp6 published
Oct 5, 2026 by JohnMcLearHigh -
OIDC interactive login accepts the literal "undefined"/"null" as the password for accounts that have noneGHSA-62cj-9j72-mfrh published
Sep 21, 2026 by JohnMcLearModerate -
Stored XSS in HTML diff export via unescaped author color values in getHTMLFromAtextGHSA-6vx2-3gwr-958v published
Sep 17, 2026 by JohnMcLearModerate -
Etherpad: SSRF via image-src filter bypass in DOCX/PDF/ODT export pipelineGHSA-x4mj-5635-3fq9 published
Oct 27, 2026 by JohnMcLearModerate -
Pre-auth arbitrary file readGHSA-mc8w-wjhw-45x5 published
Oct 27, 2026 by JohnMcLearCritical -
Embedded OIDC provider: hardcoded cookie signing key allows forged provider cookies, and clientBasedCORS reflects arbitrary originsGHSA-pp5v-mvwg-76mp published
Oct 27, 2026 by JohnMcLearModerate
Learn more about advisories related to ether/etherpad in the GitHub Advisory Database