In Etherpad-lite before version 3.1.0, the ImportHandler and ExportHandler generate temporary file paths using Math.random() placed in the system temporary directory (os.tmpdir()). On systems where the temporary directory is shared and world-writable, an attacker with local access can predict these filenames and create symbolic links pointing to files writable by the Etherpad process. When Etherpad writes to these temporary files during import or export, it follows the symbolic links and overwrites the target files with partially attacker-controlled data. This symlink-based file overwrite vulnerability is addressed in version 3.1.0.

A local unprivileged attacker can cause Etherpad-lite to overwrite arbitrary files accessible by the Etherpad process by exploiting predictable temporary filenames and symbolic link creation. This can lead to partial integrity compromise of files. The CVSS score is 4.2 (medium severity), reflecting limited attack vector (local), high attack complexity, and partial impact on confidentiality and integrity without availability impact.

Upgrade Etherpad-lite to version 3.1.0 or later, where this vulnerability is fixed. The fix removes the use of predictable Math.random() for temporary filenames, preventing symlink-based overwrites. No other mitigation is required if the upgrade is applied.