Description
Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.1 through 1.5.2 allows remote attackers to read arbitrary files by leveraging replacement of backslashes with slashes in the path parameter of HTTP API requests.
References (4)
Core 4
Core References
Mailing List, Third Party Advisory mailing-list
x_refsource_mlist
http://www.openwall.com/lists/oss-security/2015/04/11/1
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/74056
Third Party Advisory x_refsource_confirm
https://github.com/ether/etherpad-lite/commit/9d4e5f6
Mailing List, Third Party Advisory mailing-list
x_refsource_mlist
http://www.openwall.com/lists/oss-security/2015/04/12/1
Scores
CVSS v3
7.5
EPSS
0.0381
EPSS Percentile
88.2%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Details
CWE
CWE-22
Status
published
Products (26)
etherpad/etherpad
1.1.1
etherpad/etherpad
1.1.2
etherpad/etherpad
1.1.3
etherpad/etherpad
1.1.4
etherpad/etherpad
1.1.5
etherpad/etherpad
1.2.0
etherpad/etherpad
1.2.1
etherpad/etherpad
1.2.2
etherpad/etherpad
1.2.3
etherpad/etherpad
1.2.4
... and 16 more
Published
Jul 07, 2017
Tracked Since
Feb 18, 2026