Etherpad versions 2.1.0 through 3.0.x expose an admin interface to attacker‑controlled ‘x-proxy-path’ headers that are reflected into the /admin pages without sanitization, Vary, or Cache‑Control headers. The improper handling of this proxy header (CWE‑444) and lack of sanitization lead to cache‑poisoning cross‑site scripting (CWE‑79). In addition, version 3.0.0 concatenates a protocol‑relative ‘x-proxy-path’ into the /p/:pad/timeslider redirect, permitting an attacker to cause an open redirect (CWE‑601) to a malicious host. Admins following the redirect can be lured to phishing or compromised sites, and the XSS payload could compromise data, impersonate users, or elevate privileges within the Etherpad instance.

Affected deployments are those running Etherpad 2.1.0 up to 3.0.x, inclusive. The bug was fixed in version 3.1.0, so only installations that have not applied that update remain vulnerable. Administrators accessing the /admin interface or using the timeslider redirect in those version ranges are at risk whenever the application accepts client-supplied ‘x-proxy-path’ headers. Etherpad (ether:etherpad) is the sole vendor product listed, and the known CPE strings map to those same versions.

The CVSS score of 6.1 indicates a moderate severity vulnerability. No EPSS score is available, and the issue is not published in the CISA KEV catalog, suggesting limited public exploitation data. The attack vector requires an attacker to send a request with a crafted ‘x-proxy-path’ header to the Etherpad instance; if the environment uses a shared reverse proxy or CDN that forwards this header and caches the admin pages, the injected script can be delivered to any administrator who views the cached page. For the open‑redirect flaw, an attacker needs only to set the protocol‑relative header in a request to the timeslider endpoint; the redirect then points the client to the attacker‑controlled domain. Both weaknesses rely on the application trusting an untrusted header, so the exploit is feasible in environments where this header is accepted without filtering.