Etherpad’s import and export handlers generate temporary filenames by calling Math.random() and place them in the operating system’s temporary directory. On hosts where /tmp is shared and world‑writable, an unprivileged local attacker can predict a filename and pre‑create a symbolic link to a file that the Etherpad process can write. When an import or export operation follows this link, the file targeted by the link is overwritten with attacker‑controlled content. This flaw allows attackers to modify Etherpad’s own files or configuration files, potentially enabling code injection or privilege escalation within the application. The weakness is reflected in CWE‑377 and CWE‑59, and the CVSS score of 4.2 indicates a low to moderate severity.

Etherpad instances running any release prior to 3.1.0 are affected. The flaw exists in the ImportHandler and ExportHandler modules and affects all users who may trigger import or export operations on a host with a shared temporary directory.

The likely attack vector is Local (L), as the attacker must be able to create a symbolic link in the shared temporary directory. The CVSS score of 4.2 indicates a low to moderate severity, and the absence of an EPSS score together with no listing in the CISA KEV catalog suggests limited exploitation activity. In environments where Etherpad runs on a host with a world‑writable /tmp directory, the risk of an attacker overwriting critical application files is moderate; however, systems that restrict /tmp or isolate user permissions mitigate this threat.