CVE-2021-43802

CVE-2021-43802 is a high-severity vulnerability affecting Etherpad versions prior to 1.8.16. An attacker can craft a malicious *.etherpad file that, when imported, allows them to gain administrative privileges and subsequently install plugins to execute arbitrary code. This attack requires the deletion or cleanup of express-session state, which is not a core Etherpad function. The vulnerability has a CVSS score of 8.8 (High) due to its network attack vector, low complexity, and high impact on confidentiality, integrity, and availability. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.