Vulnerability in Etherpad Affects File Management Operations

CVE-2026-55086

What is CVE-2026-55086?

Etherpad, a real-time collaborative editing tool, has a security issue where temporary filenames are derived from unpredictable random values. This flaw allows an unprivileged attacker on a shared writable temporary directory to predict filenames and create symbolic links to overwrite files during import or export operations. The risk arises from operations that utilize functions like fs.writeFile and fs.rename, enabling the attacker to manipulate the output and potentially inject partially controlled content into targeted files. This vulnerability was addressed and fixed in version 3.1.0.

References