PatchSiren cyber security CVE debrief
CVE-2026-55087 ether CVE debrief
Etherpad is vulnerable to cross-site scripting (XSS) attacks due to improper sanitization of the x-proxy-path request header in versions from 2.1.0 to 3.0.0. This allows an attacker to inject malicious scripts into HTML, JavaScript, and CSS under the /admin path. A shared proxy or CDN can cache the resulting response and serve attacker-injected script to an administrator. The issue is exploitable when client-supplied x-proxy-path headers reach Etherpad. To verify, defenders should review deployment configurations, check for exposure, and monitor for suspicious activity related to x-proxy-path headers and /admin path access. The fix is in version 3.1.0. Additional verification steps include reviewing proxy and CDN configurations for potential caching of malicious responses. Confirm whether affected Etherpad deployments exist in managed environments and assign an owner for follow-up. Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Review compensating controls for exposed systems while remediation is scheduled and verified. Check relevant monitoring, detection, and logs for exposed assets that need extra review. Track exceptions, retest remediated assets, and close the item only after evidence is documented.
- Vendor
- ether
- Product
- etherpad
- CVSS
- MEDIUM 6.1
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-08-19
- Original CVE updated
- 2026-08-21
- Advisory published
- 2026-08-19
- Advisory updated
- 2026-08-21
Who should care
Administrators and users of Etherpad deployments, especially those permitting client-supplied x-proxy-path headers, should be aware of this vulnerability and take steps to patch or mitigate it. This includes reviewing deployment configurations, monitoring for suspicious activity, and ensuring that proxy and CDN configurations do not cache malicious responses. Security teams should also verify that relevant monitoring and detection systems are in place to identify potential exploitation attempts.
Technical summary
Etherpad versions from 2.1.0 to 3.1.0 are vulnerable to cross-site scripting (XSS) attacks due to improper sanitization of the x-proxy-path request header. This allows an attacker to inject malicious scripts into HTML, JavaScript, and CSS under the /admin path. A shared proxy or CDN can cache the resulting response and serve attacker-injected script to an administrator. The issue is fixed in version 3.1.0. To prevent potential XSS attacks, administrators should prioritize patching and review deployment configurations.
Defensive priority
Administrators of Etherpad deployments should prioritize patching to prevent potential XSS attacks.
Recommended defensive actions
- Patch Etherpad to version 3.1.0 or later
- Restrict client-supplied x-proxy-path headers
- Monitor for suspicious activity
- Review and update deployment configurations
- Verify proxy and CDN configurations for caching
- Check relevant monitoring, detection, and logs for exposed assets
- Track exceptions and retest remediated assets
Evidence notes
The CVE record and NVD details indicate that Etherpad versions from 2.1.0 to 3.1.0 are vulnerable to XSS attacks due to improper sanitization of the x-proxy-path request header. The issues are exploitable when client-supplied x-proxy-path headers reach Etherpad. To verify, defenders should review deployment configurations, check for exposure, and monitor for suspicious activity related to x-proxy-path headers and /admin path access. The fix is in version 3.1.0. Additional verification steps include reviewing proxy and CDN configurations for potential caching of malicious responses.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-19T20:17:17.720Z and has not been modified since then.