CVE-2026-55086: Etherpad Path Traversal Vulnerability

CVE-2026-55086 Overview

CVE-2026-55086 affects Etherpad, a real-time collaborative editor, in versions prior to 3.1.0. The src/node/handler/ImportHandler.ts and src/node/handler/ExportHandler.ts modules derive temporary filenames from Math.random() and place them in os.tmpdir(). A local unprivileged attacker on a host with a shared world-writable temporary directory can predict a filename and precreate a symbolic link pointing to a file writable by the Etherpad process. Subsequent import or export operations follow the symlink through fs.writeFile, fs.rename, or document-conversion output, overwriting the target with partially attacker-controlled content. The issue is tracked as [CWE-59] (Improper Link Resolution Before File Access) and is fixed in version 3.1.0.

Critical Impact
Local attackers can overwrite arbitrary files writable by the Etherpad process, enabling data corruption or partial injection of controlled content.

Affected Products

Etherpad versions prior to 3.1.0
src/node/handler/ImportHandler.ts in affected releases
src/node/handler/ExportHandler.ts in affected releases

Discovery Timeline

2026-08-19 - CVE-2026-55086 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-55086

Vulnerability Analysis

Etherpad generates temporary filenames for import and export operations using Math.random(). The generated paths are created inside os.tmpdir(), which on many Linux and Unix hosts is a shared, world-writable directory such as /tmp. Because Math.random() is not a cryptographic primitive and the naming scheme is predictable, a co-located local attacker can enumerate likely candidate names before the Etherpad process creates them.

When the attacker precreates a symbolic link at the predicted path pointing to a file owned or writable by the Etherpad service account, the subsequent file operation follows the link. Calls including fs.writeFile, fs.rename, and any document-conversion tool that writes to the derived path will target the linked destination. The result is a symlink-based file overwrite in which the attacker controls the destination and partially controls the written content through crafted import payloads.

Root Cause

The root cause is the combination of predictable filename generation via Math.random(), use of a shared temporary directory, and file operations that do not use O_NOFOLLOW or equivalent link-safe semantics. This matches [CWE-59] Improper Link Resolution Before File Access.

Attack Vector

Exploitation requires local access to the host and permission to write into the shared temporary directory used by Etherpad. The attacker predicts a filename, places a symlink, and waits for or induces an import or export operation. The vector is local with high attack complexity due to the race window and prediction requirement.

The fix is applied in the pull request tracked at Etherpad PR #7784 and shipped in Etherpad release v3.1.0. See the security advisory GHSA-2jwf-f4xq-f24h for full details.

Detection Methods for CVE-2026-55086

Indicators of Compromise

Unexpected symbolic links inside os.tmpdir() (commonly /tmp) that reference files owned by the Etherpad service account.
Etherpad-owned files modified shortly after an import or export operation without a corresponding administrator change.
Import or export operations that fail with errors referencing existing files or path types.

Detection Strategies

Audit process file access using Linux auditd rules on openat and renameat syscalls originating from the Etherpad process to catch writes that traverse symlinks.
Monitor Etherpad application logs for import and export failures correlated with filesystem errors in the temporary directory.
Inventory Etherpad installations and flag any running a version earlier than 3.1.0.

Monitoring Recommendations

Alert on creation of symlinks in /tmp by non-root, non-Etherpad users targeting Etherpad-writable paths.
Track file integrity of Etherpad configuration, data, and runtime files for unexpected content changes.
Correlate local shell activity on the Etherpad host with import and export events in application logs.

How to Mitigate CVE-2026-55086

Immediate Actions Required

Upgrade Etherpad to version 3.1.0 or later, which replaces predictable temporary filenames with a link-safe implementation.
Restrict local shell access on Etherpad hosts to trusted administrators only.
Review and revoke unnecessary local accounts on any server running Etherpad.

Patch Information

The fix is delivered in Etherpad 3.1.0 via commit 8c6104c and pull request #7784. Administrators should follow the upgrade procedure documented in the v3.1.0 release notes and verify version strings after deployment.

Workarounds

Configure Etherpad to use a private temporary directory that is not world-writable, for example by setting TMPDIR for the service unit to a path owned exclusively by the Etherpad user.
Apply the sticky bit and strict permissions to /tmp and confirm that no unprivileged users can create files there if Etherpad must continue using the default location.
Run Etherpad inside a container or systemd unit with PrivateTmp=yes to isolate the temporary namespace from other local users.

bash

# systemd unit hardening example for the Etherpad service
[Service]
PrivateTmp=yes
ProtectSystem=strict
ProtectHome=yes
NoNewPrivileges=yes
ReadWritePaths=/var/lib/etherpad
Environment=TMPDIR=/var/lib/etherpad/tmp