CVE-2015-3309: Etherpad

High severity, CVSS 7.5. EPSS: 2.3% chance of exploitation in the next 30 days.

Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.2 through 1.5.4 allows remote attackers to read arbitrary files with permissions of the user running the service via a .. (dot dot) in the path parameter of HTTP API requests. NOTE: This vulnerability is due to an incomplete fix to CVE-2015-3297.

Affected products

• Etherpad Etherpad: from 1.1.2, up to and including 1.5.4

Published 2020-02-13. Last modified 2026-06-17.