CVE-2015-2298: Etherpad

High severity, CVSS 7.5. EPSS: 2.3% chance of exploitation in the next 30 days.

node/utils/ExportEtherpad.js in Etherpad 1.5.x before 1.5.2 might allow remote attackers to obtain sensitive information by leveraging an improper substring check when exporting a padID.

Affected products

• Etherpad Etherpad: version 1.5.0 only; version 1.5.1 only

Published 2018-01-12. Last modified 2026-06-17.