Security readout for executives and security teams
Plain-English summary
A malicious Etherpad contributor can plant content that runs in another viewer’s browser when a pad or its timeslider is opened. An administrator viewing the content may also be affected. This creates serious confidentiality and integrity risk. Etherpad versions before 3.3.1 are vulnerable; version 3.3.1 fixes the issue.
Executive priority
Treat remediation as urgent, especially for externally reachable or broadly writable deployments. Prioritize systems used by administrators or handling sensitive collaboration. Upgrade to 3.3.1 or later and apply temporary access restrictions until completion.
Technical view
A crafted .etherpad import can supply a malicious numbered-list start value through the attribute pool. result.appendSpan inserts that value into an unquoted HTML attribute and assigns the markup to innerHTML, enabling stored cross-site scripting when a victim opens the pad or /timeslider.
Likely exposure
Exposure exists on Etherpad deployments earlier than 3.3.1 where an attacker can write to a pad or introduce a crafted .etherpad import. Internet-accessible, broadly writable, or administrator-used deployments deserve the fastest attention. The supplied data contains no CPE-based inventory mapping.
Exploitation context
The supplied sources do not report active exploitation, and the CVE is not identified as being in KEV. Exploitation requires attacker-controlled content to be stored and another user to view the affected pad or timeslider. Administrator viewing could substantially increase impact.
Researcher notes
The vulnerable flow is attributed to ImportEtherpad.setPadRaw accepting attacker-controlled attribute-pool values and result.appendSpan interpolating the list start value into markup assigned to innerHTML. The vendor advisory, remediation pull request, fixing commit, and 3.3.1 release are supplied. No active-exploitation evidence or CPE mappings are provided.
Mitigation direction
- Upgrade every Etherpad instance to version 3.3.1 or later.
- Until upgraded, restrict pad writing and .etherpad imports to trusted users.
- Advise administrators not to open suspect pads or timeslider views before remediation.
Validation and detection
- Inventory Etherpad deployments and record each running version.
- Confirm no production instance runs a version earlier than 3.3.1.
- Review whether untrusted users can write pads or submit .etherpad imports.
- After upgrading, verify normal pad and timeslider rendering in a controlled test.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-55085 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.6 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L2.86GitHub_MVulnerability scoring details
Base CVSS 3.1 score
9.6CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/ether/etherpad/security/advisories/GHSA-f7h5-v9hm-548jCVE reference, GitHub_M · x_refsource_CONFIRM
- https://github.com/ether/etherpad/pull/7937CVE reference, GitHub_M · x_refsource_MISC
- https://github.com/ether/etherpad/commit/d828185efcac9abc2e46e6da1c171393500fa319CVE reference, GitHub_M · x_refsource_MISC
- https://github.com/ether/etherpad/releases/tag/v3.3.1CVE reference, GitHub_M · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.