CVE-2015-3309

Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.2 through 1.5.4 allows remote attackers to read arbitrary files with permissions of the user running the service via a .. (dot dot) in the path parameter of HTTP API requests. NOTE: This vulnerability is due to an incomplete fix to CVE-2015-3297.

• CWE-22

• http://cve.killedkenny.io/cve/CVE-2015-3309Third Party Advisory
• http://www.openwall.com/lists/oss-security/2015/04/16/8Mailing List, Third Party Advisory
• https://github.com/ether/etherpad-lite/commit/0fa7650df8f940ed6b577d79836a78eb09726c4bThird Party Advisory
• http://cve.killedkenny.io/cve/CVE-2015-3309Third Party Advisory
• http://www.openwall.com/lists/oss-security/2015/04/16/8Mailing List, Third Party Advisory
• https://github.com/ether/etherpad-lite/commit/0fa7650df8f940ed6b577d79836a78eb09726c4bThird Party Advisory

Published

Feb 13, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-3300Multiple cross-site scripting (XSS) vulnerabilities in the T…
• CVE-2015-3301Directory traversal vulnerability in the TheCartPress eComme…
• CVE-2015-3302The TheCartPress eCommerce Shopping Cart (aka The Profession…
• CVE-2015-3306The mod_copy module in ProFTPD 1.3.5 allows remote attackers…
• CVE-2015-3307The phar_parse_metadata function in ext/phar/phar.c in PHP b…
• CVE-2015-3308Double free vulnerability in lib/x509/x509_ext.c in GnuTLS b…
• CVE-2015-3310Buffer overflow in the rc_mksid function in plugins/radius/u…
• CVE-2015-3313SQL injection vulnerability in WordPress Community Events pl…
• CVE-2015-3314SQL injection vulnerability in WordPress Tune Library plugin…
• CVE-2015-3315Automatic Bug Reporting Tool (ABRT) allows local users to re…
• CVE-2015-3316CA Common Services, as used in CA Client Automation r12.5 SP…
• CVE-2015-3317CA Common Services, as used in CA Client Automation r12.5 SP…