Etherpad, a real-time collaborative editor, improperly neutralizes input from the x-proxy-path request header in versions >=2.1.0 and <3.1.0. This header is used without sanitization in the /admin interface, leading to cross-site scripting risks. The lack of appropriate cache control headers allows shared proxies or CDNs to cache malicious responses, potentially exposing administrators to attacker-injected scripts. In version 3.0.0, the x-proxy-path header can also be used in protocol-relative redirects, facilitating redirection to malicious hosts. These issues require that the deployment environment permits client-supplied x-proxy-path headers to reach Etherpad. The issues are resolved in version 3.1.0.

An attacker able to supply the x-proxy-path header can inject malicious scripts into the Etherpad /admin interface, potentially leading to cross-site scripting attacks against administrators. Cached malicious responses by shared proxies or CDNs can cause persistent exposure. The redirect issue in version 3.0.0 can lead to redirection to attacker-controlled hosts. The confidentiality and integrity of administrative sessions may be compromised. There is no indication of availability impact or known exploitation in the wild.

Upgrade Etherpad to version 3.1.0 or later, where these vulnerabilities are fixed. Ensure that client-supplied x-proxy-path headers cannot reach the Etherpad server if upgrading is not immediately possible. Review proxy and CDN caching policies to prevent caching of responses that depend on client-controlled headers. No additional vendor advisory content is provided; patch status is confirmed by the fixed version 3.1.0.