CVE-2026-55087: ep_etherpad-lite: Cache-poisoning Cross-site Scripting and Open Redirect via x-proxy-path Header
Etherpad lets operators run behind a reverse proxy that prefixes every route with a subpath (e.g. /pad/etherpad/...). The proxy is expected to set x-proxy-path: /pad/etherpad on every request so that server-rendered links, asset URLs, and redirects know to include the prefix. Two server-side call sites historically processed this header:
References
- github.com/advisories/GHSA-fjgc-3mj7-8rg8
- github.com/ether/etherpad/commit/451bd9c3ebb0dded99dd0ff21811ee00e0940c29
- github.com/ether/etherpad/commit/63e9b2d4eb303cd341022591bdf9484584db36e3
- github.com/ether/etherpad/pull/6399
- github.com/ether/etherpad/pull/7710
- github.com/ether/etherpad/pull/7784
- github.com/ether/etherpad/security/advisories/GHSA-fjgc-3mj7-8rg8
- nvd.nist.gov/vuln/detail/CVE-2026-55087
Code Behaviors & Features
Detect and mitigate CVE-2026-55087 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →