GHSA-92hr-gmr6-h8cp: Path Traversal
Fix: PR #7906 (ether/etherpad). A set of medium/low hardening fixes:
- Weak RNG for tokens (CWE-330): author/session/readonly IDs were generated with Math.random() (client and server). Now use crypto.getRandomValues. - Login timing / no failure delay (CWE-208/CWE-307): the OIDC interaction login used a non-constant-time password compare with no failure delay. Now uses crypto.timingSafeEqual plus a uniform failure delay; user lookup is own-property only. - Plugin dependency path handling (CWE-22): plugin dependency names from package.json were used to build filesystem paths without validation (admin-gated install). Now validated against the npm name grammar. - API parameter pollution (CWE-235): /api/2 merged all request headers into the API field set. Now forwards only authorization, matching the openapi.ts handler. - Pad-creation side effect: API.appendChatMessage could create arbitrary pads (missing getPadSafe). Now requires the pad to exist. - Error info disclosure (CWE-209): the admin file server echoed filesystem error detail; now returns a generic message.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/ep_etherpad-liteto a version that resolves this vulnerability.Fixed in 3.3.0 - Upgrade
Upgrade
ether/etherpadto a version that resolves this vulnerability.Patch PR #7906 - Configuration
Update the /api/2 handler to forward only the 'authorization' request header (as in openapi.ts), instead of merging all request headers into the API field set.
API handler (openapi.ts) for /api/2 request header forwarding = forward only 'authorization' header; do not merge all request headers into API field set - Configuration
Modify the admin file server so that it no longer echoes filesystem error detail and instead returns a generic message.
Admin file server filesystem error response detail = generic message (no filesystem error detail) - Configuration
Change the OIDC interaction login to use crypto.timingSafeEqual for constant-time password comparison, add a uniform failure delay on authentication failure, and ensure user lookup is 'own-property' only.
OIDC login/password comparison password compare and failure delay = use crypto.timingSafeEqual with a uniform failure delay; perform user lookup as own-property only - Configuration
Update API.appendChatMessage so it no longer creates arbitrary pads and instead requires the pad to exist (e.g., via getPadSafe guard / existence requirement).
API.appendChatMessage pad creation behavior = require pad to exist (no arbitrary pad creation) - Configuration
Validate plugin dependency names from package.json against the npm name grammar before using them to build filesystem paths.
Admin-gated plugin dependency installer dependency name to filesystem path handling = validate dependency names against the npm name grammar before building filesystem paths - Configuration
Replace Math.random()-based generation of author/session/readonly IDs with crypto.getRandomValues on both client and server.
Token ID generation (author/session/readonly) RNG for tokens = crypto.getRandomValues (client and server)
Event History
Frequently Asked Questions
What is the severity of GHSA-92hr-gmr6-h8cp?
The severity of GHSA-92hr-gmr6-h8cp is classified as medium/low risk.
How do I fix GHSA-92hr-gmr6-h8cp?
You can fix GHSA-92hr-gmr6-h8cp by updating to the version that includes the changes from PR #7906.
What vulnerabilities are addressed in GHSA-92hr-gmr6-h8cp?
GHSA-92hr-gmr6-h8cp addresses weaknesses related to weak RNG for tokens and login timing issues.
What is the impact of weak RNG in GHSA-92hr-gmr6-h8cp?
The impact of weak RNG in GHSA-92hr-gmr6-h8cp can lead to predictable token generation, compromising security.
When was GHSA-92hr-gmr6-h8cp published?
GHSA-92hr-gmr6-h8cp was published on August 17, 2026.