Read the docs
TI-2015-02917 Aliases CVE-2015-3297GHSA-487r-wq2j-f8m4

Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.1 through 1.5.2…

Priority MEDIUM 41CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.1 through 1.5.2 allows remote attackers to read arbitrary files by leveraging replacement of backslashes with slashes in the path parameter of HTTP API requests.

Why it matters now

EPSS 0.04955 92nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 26

CPEVersionsRoleVendor
cpe:2.3:a:etherpad:etherpad:1.1.1:*:*:*:*:*:*:*1.1.1VulnerableEtherpad
cpe:2.3:a:etherpad:etherpad:1.1.2:*:*:*:*:*:*:*1.1.2VulnerableEtherpad
cpe:2.3:a:etherpad:etherpad:1.1.3:*:*:*:*:*:*:*1.1.3VulnerableEtherpad
cpe:2.3:a:etherpad:etherpad:1.1.4:*:*:*:*:*:*:*1.1.4VulnerableEtherpad
cpe:2.3:a:etherpad:etherpad:1.1.5:*:*:*:*:*:*:*1.1.5VulnerableEtherpad
cpe:2.3:a:etherpad:etherpad:1.2.0:*:*:*:*:*:*:*1.2.0VulnerableEtherpad
cpe:2.3:a:etherpad:etherpad:1.2.1:*:*:*:*:*:*:*1.2.1VulnerableEtherpad
cpe:2.3:a:etherpad:etherpad:1.2.2:*:*:*:*:*:*:*1.2.2VulnerableEtherpad
cpe:2.3:a:etherpad:etherpad:1.2.3:*:*:*:*:*:*:*1.2.3VulnerableEtherpad
cpe:2.3:a:etherpad:etherpad:1.2.4:*:*:*:*:*:*:*1.2.4VulnerableEtherpad
  • cpe:2.3:a:etherpad:etherpad:1.1.1:*:*:*:*:*:*:* Versions 1.1.1 Vulnerable ·Etherpad
  • cpe:2.3:a:etherpad:etherpad:1.1.2:*:*:*:*:*:*:* Versions 1.1.2 Vulnerable ·Etherpad
  • cpe:2.3:a:etherpad:etherpad:1.1.3:*:*:*:*:*:*:* Versions 1.1.3 Vulnerable ·Etherpad
  • cpe:2.3:a:etherpad:etherpad:1.1.4:*:*:*:*:*:*:* Versions 1.1.4 Vulnerable ·Etherpad
  • cpe:2.3:a:etherpad:etherpad:1.1.5:*:*:*:*:*:*:* Versions 1.1.5 Vulnerable ·Etherpad
  • cpe:2.3:a:etherpad:etherpad:1.2.0:*:*:*:*:*:*:* Versions 1.2.0 Vulnerable ·Etherpad
  • cpe:2.3:a:etherpad:etherpad:1.2.1:*:*:*:*:*:*:* Versions 1.2.1 Vulnerable ·Etherpad
  • cpe:2.3:a:etherpad:etherpad:1.2.2:*:*:*:*:*:*:* Versions 1.2.2 Vulnerable ·Etherpad
  • cpe:2.3:a:etherpad:etherpad:1.2.3:*:*:*:*:*:*:* Versions 1.2.3 Vulnerable ·Etherpad
  • cpe:2.3:a:etherpad:etherpad:1.2.4:*:*:*:*:*:*:* Versions 1.2.4 Vulnerable ·Etherpad
Show 16 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:etherpad:etherpad:1.2.5:*:*:*:*:*:*:*1.2.5VulnerableEtherpad
cpe:2.3:a:etherpad:etherpad:1.2.6:*:*:*:*:*:*:*1.2.6VulnerableEtherpad
cpe:2.3:a:etherpad:etherpad:1.2.7:*:*:*:*:*:*:*1.2.7VulnerableEtherpad
cpe:2.3:a:etherpad:etherpad:1.2.8:*:*:*:*:*:*:*1.2.8VulnerableEtherpad
cpe:2.3:a:etherpad:etherpad:1.2.9:*:*:*:*:*:*:*1.2.9VulnerableEtherpad
cpe:2.3:a:etherpad:etherpad:1.2.10:*:*:*:*:*:*:*1.2.10VulnerableEtherpad
cpe:2.3:a:etherpad:etherpad:1.2.11:*:*:*:*:*:*:*1.2.11VulnerableEtherpad
cpe:2.3:a:etherpad:etherpad:1.2.12:*:*:*:*:*:*:*1.2.12VulnerableEtherpad
cpe:2.3:a:etherpad:etherpad:1.2.81:*:*:*:*:*:*:*1.2.81VulnerableEtherpad
cpe:2.3:a:etherpad:etherpad:1.2.91:*:*:*:*:*:*:*1.2.91VulnerableEtherpad
cpe:2.3:a:etherpad:etherpad:1.3.0:*:*:*:*:*:*:*1.3.0VulnerableEtherpad
cpe:2.3:a:etherpad:etherpad:1.4.0:*:*:*:*:*:*:*1.4.0VulnerableEtherpad
cpe:2.3:a:etherpad:etherpad:1.4.1:*:*:*:*:*:*:*1.4.1VulnerableEtherpad
cpe:2.3:a:etherpad:etherpad:1.5.0:*:*:*:*:*:*:*1.5.0VulnerableEtherpad
cpe:2.3:a:etherpad:etherpad:1.5.1:*:*:*:*:*:*:*1.5.1VulnerableEtherpad
cpe:2.3:a:etherpad:etherpad:1.5.2:*:*:*:*:*:*:*1.5.2VulnerableEtherpad
  • cpe:2.3:a:etherpad:etherpad:1.2.5:*:*:*:*:*:*:* Versions 1.2.5 Vulnerable ·Etherpad
  • cpe:2.3:a:etherpad:etherpad:1.2.6:*:*:*:*:*:*:* Versions 1.2.6 Vulnerable ·Etherpad
  • cpe:2.3:a:etherpad:etherpad:1.2.7:*:*:*:*:*:*:* Versions 1.2.7 Vulnerable ·Etherpad
  • cpe:2.3:a:etherpad:etherpad:1.2.8:*:*:*:*:*:*:* Versions 1.2.8 Vulnerable ·Etherpad
  • cpe:2.3:a:etherpad:etherpad:1.2.9:*:*:*:*:*:*:* Versions 1.2.9 Vulnerable ·Etherpad
  • cpe:2.3:a:etherpad:etherpad:1.2.10:*:*:*:*:*:*:* Versions 1.2.10 Vulnerable ·Etherpad
  • cpe:2.3:a:etherpad:etherpad:1.2.11:*:*:*:*:*:*:* Versions 1.2.11 Vulnerable ·Etherpad
  • cpe:2.3:a:etherpad:etherpad:1.2.12:*:*:*:*:*:*:* Versions 1.2.12 Vulnerable ·Etherpad
  • cpe:2.3:a:etherpad:etherpad:1.2.81:*:*:*:*:*:*:* Versions 1.2.81 Vulnerable ·Etherpad
  • cpe:2.3:a:etherpad:etherpad:1.2.91:*:*:*:*:*:*:* Versions 1.2.91 Vulnerable ·Etherpad
  • cpe:2.3:a:etherpad:etherpad:1.3.0:*:*:*:*:*:*:* Versions 1.3.0 Vulnerable ·Etherpad
  • cpe:2.3:a:etherpad:etherpad:1.4.0:*:*:*:*:*:*:* Versions 1.4.0 Vulnerable ·Etherpad
  • cpe:2.3:a:etherpad:etherpad:1.4.1:*:*:*:*:*:*:* Versions 1.4.1 Vulnerable ·Etherpad
  • cpe:2.3:a:etherpad:etherpad:1.5.0:*:*:*:*:*:*:* Versions 1.5.0 Vulnerable ·Etherpad
  • cpe:2.3:a:etherpad:etherpad:1.5.1:*:*:*:*:*:*:* Versions 1.5.1 Vulnerable ·Etherpad
  • cpe:2.3:a:etherpad:etherpad:1.5.2:*:*:*:*:*:*:* Versions 1.5.2 Vulnerable ·Etherpad

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2015-3297
  2. 2026-10-03 Alias added: GHSA-487r-wq2j-f8m4

References

Advisory 3

  • TI-2021-19608 Admin privilege escalation and arbitrary code execution via malicious *.etherpad imports CVSS 3.1CRITICAL 9.9
  • TI-2018-06747 Etherpad 1.6.3 before 1.6.4 allows an attacker to execute arbitrary code. CVSS 3.0CRITICAL 9.8
  • TI-2018-04991 node/hooks/express/apicalls.js in Etherpad Lite before v1.6.3 mishandles JSONP, which… CVSS 3.0CRITICAL 9.8
  • TI-2018-06748 Etherpad 1.5.x and 1.6.x before 1.6.4 allows an attacker to execute arbitrary code on the… CVSS 3.0HIGH 8.1
  • TI-2015-03442 Directory traversal vulnerability in node/hooks/express/tests.js in Etherpad frontend tests before 1.6.1. CVSS 3.0HIGH 7.5
  • TI-2015-02926 Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.2 through 1.5.4… CVSS 3.1HIGH 7.5
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences