Description

Etherpad is a real-time collaborative editor. Prior to 3.1.0, src/node/handler/ImportHandler.ts and src/node/handler/ExportHandler.ts derive temporary filenames from Math.random() and place them in os.tmpdir(). On a host with a shared world-writable temporary directory, a local unprivileged attacker who predicts a filename can precreate a symbolic link to a file writable by the Etherpad process. Subsequent import or export operations can follow the link through fs.writeFile, fs.rename, or document-conversion output and overwrite the target with partially attacker-controlled content. This issue is fixed in version 3.1.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.2",
  "pubDate": "2026-08-19T20:17:17.520Z",
  "pubdate": "2026-08-19T20:17:17.520Z",
  "executiveSummary": "An insecure temporary file creation vulnerability exists in Etherpad prior to version 3.1.0, specifically within src/node/handler/ImportHandler.ts and src/node/handler/ExportHandler.ts.\nThe vulnerability allows a local unprivileged attacker with the ability to predict filenames derived from Math.random() in a shared world-writable temporary directory (os.tmpdir()) to precreate symbolic links pointing to sensitive files writable by the Etherpad process.\nSubsequent import or export operations follow these symbolic links via functions such as fs.writeFile, fs.rename, or document-conversion output, resulting in the arbitrary overwriting of target files with partially attacker-controlled content.\nThe risk implication is potential local privilege escalation, arbitrary file overwrite, and system integrity compromise.\nExploitation requires local unprivileged access to the host, a shared world-writable temporary directory, and the ability to predict or race the weak cryptographic pseudo-random number generator used for temporary filename generation.",
  "technicalDetails": "The root cause of the vulnerability is the use of an insecure pseudo-random number generator, specifically Math.random(), combined with predictable temporary file derivation mechanisms in src/node/handler/ImportHandler.ts and src/node/handler/ExportHandler.ts.\nTemporary files and directories are instantiated directly within the shared world-writable system directory accessed via os.tmpdir() without ensuring atomic creation or secure permissions.\nAuthentication and privilege requirements are minimal: the attacker requires local unprivileged access to the underlying host operating system running the Etherpad process.\nThe network exposure is local, as the attack vector relies on local filesystem interactions rather than direct remote network exploitation.\nThe attack flow proceeds as follows: First, the local attacker analyzes the filename generation logic relying on Math.random() to predict upcoming temporary filenames utilized during import and export routines.\nSecond, the attacker pre-creates a symbolic link inside os.tmpdir() targeting a critical file that is writable by the user context executing the Etherpad process.\nThird, when a legitimate user triggers an import or export operation, Etherpad invokes file system operations including fs.writeFile, fs.rename, or document-conversion output mechanisms.\nFourth, these file system operations unwittingly follow the attacker-controlled symbolic link rather than securely generating a distinct file descriptor.\nFinally, the payload behavior results in the target file being overwritten with data influenced or partially controlled by the attacker, compromising system integrity or potentially facilitating privilege escalation depending on the overwritten file."
}