CVE-2026-30587

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-30587
Multiple Stored XSS vulnerabilities exist in Seafile Server version 13.0.15,13.0.16-pro,12.0.14 and prior and fixed in 13.0.17, 13.0.17-pro, and 12.0.20-pro, via the Seadoc (sdoc) editor. The application fails to properly sanitize WebSocket messages regarding document structure updates. This allows authenticated remote attackers to inject malicious JavaScript payloads via the src attribute of embedded Excalidraw whiteboards or the href attribute of anchor tags

8.7 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 5.8

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://gist.github.com/gabdevele/1b7e30ab367b26042fa32f45aa12ce2f Exploit Third Party Advisory
https://github.com/haiwen/seadoc-editor/commit/8fa988aaede072b2ae073d1b2edcb2fc691423b2 Patch
https://github.com/haiwen/seahub/commit/4c5301747bdb84c64b2f2b3230417df2d1cc8987 Patch
https://manual.seafile.com/12.0/changelog/changelog-for-seafile-professional-server/ Release Notes
https://manual.seafile.com/13.0/changelog/changelog-for-seafile-professional-server/ Release Notes
https://manual.seafile.com/13.0/changelog/server-changelog/ Release Notes
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:seafile:seafile_server:*:*:*:*:professional:*:*:*
cpe:2.3:a:seafile:seafile_server:13.0.15:*:*:*:community:*:*:*
cpe:2.3:a:seafile:seafile_server:13.0.16:*:*:*:professional:*:*:*
History

31 Mar 2026, 18:56

Type Values Removed Values Added
CWE CWE-79
First Time Seafile seafile Server
Seafile
References () https://gist.github.com/gabdevele/1b7e30ab367b26042fa32f45aa12ce2f - () https://gist.github.com/gabdevele/1b7e30ab367b26042fa32f45aa12ce2f - Exploit, Third Party Advisory
References () https://github.com/haiwen/seadoc-editor/commit/8fa988aaede072b2ae073d1b2edcb2fc691423b2 - () https://github.com/haiwen/seadoc-editor/commit/8fa988aaede072b2ae073d1b2edcb2fc691423b2 - Patch
References () https://github.com/haiwen/seahub/commit/4c5301747bdb84c64b2f2b3230417df2d1cc8987 - () https://github.com/haiwen/seahub/commit/4c5301747bdb84c64b2f2b3230417df2d1cc8987 - Patch
References () https://manual.seafile.com/12.0/changelog/changelog-for-seafile-professional-server/ - () https://manual.seafile.com/12.0/changelog/changelog-for-seafile-professional-server/ - Release Notes
References () https://manual.seafile.com/13.0/changelog/changelog-for-seafile-professional-server/ - () https://manual.seafile.com/13.0/changelog/changelog-for-seafile-professional-server/ - Release Notes
References () https://manual.seafile.com/13.0/changelog/server-changelog/ - () https://manual.seafile.com/13.0/changelog/server-changelog/ - Release Notes
CPE cpe:2.3:a:seafile:seafile_server:*:*:*:*:professional:*:*:*
cpe:2.3:a:seafile:seafile_server:13.0.16:*:*:*:professional:*:*:*
cpe:2.3:a:seafile:seafile_server:13.0.15:*:*:*:community:*:*:*
CVSS v2 : unknown
v3 : 5.4 		v2 : unknown
v3 : 8.7

27 Mar 2026, 20:16

Type Values Removed Values Added
Summary
  • (es) Múltiples vulnerabilidades de XSS Almacenado existen en Seafile Servidor versión 13.0.15, 13.0.16-pro, 12.0.14 y anteriores, y fueron corregidas en 13.0.17, 13.0.17-pro y 12.0.20-pro, a través del editor Seadoc (sdoc). La aplicación no logra sanear correctamente los mensajes de WebSocket relacionados con las actualizaciones de la estructura del documento. Esto permite a atacantes remotos autenticados inyectar cargas útiles maliciosas de JavaScript a través del atributo src de las pizarras blancas incrustadas de Excalidraw o el atributo href de las etiquetas de anclaje.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.4

25 Mar 2026, 18:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-25 18:16

Updated : 2026-03-31 18:56

NVD link : CVE-2026-30587

Mitre link : CVE-2026-30587

CVE.ORG link : CVE-2026-30587

JSON object : View

Products Affected

seafile

  • seafile_server
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')