THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-fjgc-3mj7-8rg8 (medium) — ep_etherpad-lite: Cache-poisoning Cross-site Scripting and Open Redirect via x-proxy-path Header

[GHSA] GHSA-fjgc-3mj7-8rg8 (medium) — ep_etherpad-lite: Cache-poisoning Cross-site Scripting and Open Redirect via x-proxy-path Header

highgithub_advisoriesPublished 2026-08-13

GHSA-fjgc-3mj7-8rg8 Severity: medium CVE: CVE-2026-55087

ep_etherpad-lite: Cache-poisoning Cross-site Scripting and Open Redirect via x-proxy-path Header

# GHSA-03 — `x-proxy-path` header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (open-redirect)

**Severity:** Medium **CVSS v3.1 vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N` **CVSS suggested

Indicators of compromise

CVE-2026-55087cve
https://evil.example/p/url
https://pad.example/admin/index.htmlurl
https://attacker.example/?c=url
https://pad.example/p/foo/timesliderurl
https://evil.example/p/foo`url
socket.iodomain

Original source: https://github.com/advisories/GHSA-fjgc-3mj7-8rg8