CVE-2026-55086 in Etherpad
Summary
by MITRE • 08/19/2026
Etherpad is a real-time collaborative editor. Prior to 3.1.0, src/node/handler/ImportHandler.ts and src/node/handler/ExportHandler.ts derive temporary filenames from Math.random() and place them in os.tmpdir(). On a host with a shared world-writable temporary directory, a local unprivileged attacker who predicts a filename can precreate a symbolic link to a file writable by the Etherpad process. Subsequent import or export operations can follow the link through fs.writeFile, fs.rename, or document-conversion output and overwrite the target with partially attacker-controlled content. This issue is fixed in version 3.1.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The vulnerability identified in Etherpad versions prior to 3.1.0 stems from an insecure implementation of temporary file handling within the ImportHandler and ExportHandler modules. These components are responsible for managing data ingestion and output generation, processes that inherently require the creation of intermediate files on the host operating system's filesystem. The core technical flaw lies in the method used to generate filenames for these temporary artifacts. Instead of utilizing cryptographically secure random number generators or atomic file creation primitives provided by the operating system, such as O_EXCL flags or mkstemp equivalents, the application relies on JavaScript’s Math.random() function. This pseudo-random number generator is not designed for security purposes and produces values that are predictable if an attacker can observe previous outputs or understand the underlying algorithm's seed state. Furthermore, these temporary files are placed directly into the operating system's default temporary directory, typically /tmp on Unix-like systems, which often possesses world-writable permissions to allow various processes to create their own transient data without requiring elevated privileges.
This combination of predictable naming and shared writable directories creates a classic race condition scenario known as a Time-of-Check-to-Time-of-Use vulnerability, specifically manifesting as a symlink attack or TOCTOU issue. An unprivileged local attacker operating on the same host can monitor the temporary directory for new files created by Etherpad. By predicting the next likely filename generated by Math.random(), the attacker can pre-create a symbolic link with that exact name pointing to a sensitive target file, such as /etc/passwd or another configuration file owned by the user running the Etherpad process. When the application subsequently attempts to write import data or export content using standard filesystem operations like fs.writeFile or fs.rename, it follows the symlink rather than creating a new independent temporary file. Consequently, the attacker-controlled partial content is written directly into the target location specified in the symlink. This allows for arbitrary file overwrite attacks where the attacker can inject malicious payloads, modify critical system configurations, or potentially escalate privileges if the Etherpad process runs with sufficient permissions to write to sensitive locations.
The operational impact of this vulnerability extends beyond simple data corruption. In a shared hosting environment or multi-tenant deployment, an attacker could compromise other users' data by targeting files they have access to but cannot directly modify through normal application interfaces. If the Etherpad instance is configured to run with elevated privileges for document conversion features, such as converting documents from Microsoft Office formats using external tools like LibreOffice, the risk increases significantly. The output of these conversions might be written via similar mechanisms, expanding the attack surface. This flaw aligns with CWE-379 (Creation of Temporary File in Directory with Unpredictable Name) and CWE-59 (Improper Link Resolution Before File Access). From a threat modeling perspective using the MITRE ATT&CK framework, this behavior facilitates Local Privilege Escalation through file manipulation techniques, specifically leveraging symbolic link following to bypass access controls.
Mitigation for this vulnerability requires both immediate patching and architectural improvements in how temporary files are managed within the application codebase. The primary remediation is upgrading Etherpad to version 3.1.0 or later, where the developers have addressed the insecure random number generation and improved file handling practices. Beyond updating software, system administrators should ensure that the operating environment adheres to security best practices for temporary directories. This includes mounting /tmp with noexec, nosuid, and nodev options if possible, although this does not fully mitigate symlink attacks on writable mounts. Application-level mitigations involve using secure random number generators like crypto.randomBytes in Node.js instead of Math.random(), ensuring that filenames are unpredictable even to local observers. Additionally, the application should employ atomic file creation methods or use unique temporary directories with restricted permissions for each session rather than relying on a shared world-writable space. Regular security audits and static code analysis tools configured to detect insecure random number usage can help prevent similar vulnerabilities in future development cycles.