CVE-2021-43802

Etherpad is a real-time collaborative editor. In versions prior to 1.8.16, an attacker can craft an `*.etherpad` file that, when imported, might allow the attacker to gain admin privileges for the Etherpad instance. This, in turn, can be used to install a malicious Etherpad plugin that can execute arbitrary code (including system commands). To gain privileges, the attacker must be able to trigger deletion of `express-session` state or wait for old `express-session` state to be cleaned up. Core Etherpad does not delete any `express-session` state, so the only known attacks require either a plugin that can delete session state or a custom cleanup process (such as a cron job that deletes old `sessionstorage:*` records). The problem has been fixed in version 1.8.16. If users cannot upgrade to 1.8.16 or install patches manually, several workarounds are available. Users may configure their reverse proxies to reject requests to `/p/*/import`, which will block all imports, not just `*.etherpad` imports; limit all users to read-only access; and/or prevent the reuse of `express_sid` cookie values that refer to deleted express-session state. More detailed information and general mitigation strategies may be found in the GitHub Security Advisory.

• CWE-790
• CWE-1287
• CWE-20

• https://github.com/ether/etherpad-lite/compare/b7065eb9a0ec7c3c265f8cfeb2534efe6f036456...77bcb507b30e762e9375b0511b3763e0162aae53Patch, Third Party Advisory
• https://github.com/ether/etherpad-lite/issues/5010Issue Tracking, Third Party Advisory
• https://github.com/ether/etherpad-lite/releases/tag/1.8.16Release Notes, Third Party Advisory
• https://github.com/ether/etherpad-lite/security/advisories/GHSA-w3g3-qf3g-2mqcMitigation, Patch, Third Party Advisory
• https://github.com/ether/etherpad-lite/compare/b7065eb9a0ec7c3c265f8cfeb2534efe6f036456...77bcb507b30e762e9375b0511b3763e0162aae53Patch, Third Party Advisory
• https://github.com/ether/etherpad-lite/issues/5010Issue Tracking, Third Party Advisory
• https://github.com/ether/etherpad-lite/releases/tag/1.8.16Release Notes, Third Party Advisory
• https://github.com/ether/etherpad-lite/security/advisories/GHSA-w3g3-qf3g-2mqcMitigation, Patch, Third Party Advisory

Published

Dec 9, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-43797Netty is an asynchronous event-driven network application fr…6.5
• CVE-2021-43798Grafana is an open-source platform for monitoring and observ…7.5
• CVE-2021-43799Zulip is an open-source team collaboration tool. Zulip Serve…9.8
• CVE-2021-4380The Pinterest Automatic plugin for WordPress is vulnerable t…9.8
• CVE-2021-43800Wiki.js is a wiki app built on Node.js. Prior to version 2.5…7.5
• CVE-2021-43801Mercurius is a GraphQL adapter for Fastify. Any users from M…7.5
• CVE-2021-43803Next.js is a React framework. In versions of Next.js prior t…7.5
• CVE-2021-43804PJSIP is a free and open source multimedia communication lib…7.3
• CVE-2021-43805Solidus is a free, open-source ecommerce platform built on R…7.5
• CVE-2021-43806Tuleap is a Libre and Open Source tool for end to end tracea…8.8
• CVE-2021-43807Opencast is an Open Source Lecture Capture & Video Managemen…6.5
• CVE-2021-43808Laravel is a web application framework. Laravel prior to ver…6.1