CVE-2026-30587

HIGH EPSS 19.5%
Published Mar 25, 20263mo ago · Modified Jun 17, 20262w ago
8.7 CVSS 3.1
High
Find Similar
Published Mar 25, 2026 3mo ago
Last Modified Jun 17, 2026 2w ago

Description

Multiple Stored XSS vulnerabilities exist in Seafile Server version 13.0.15,13.0.16-pro,12.0.14 and prior and fixed in 13.0.17, 13.0.17-pro, and 12.0.20-pro, via the Seadoc (sdoc) editor. The application fails to properly sanitize WebSocket messages regarding document structure updates. This allows authenticated remote attackers to inject malicious JavaScript payloads via the src attribute of embedded Excalidraw whiteboards or the href attribute of anchor tags

CVSS Details

Base Score
8.7
Exploitability
2.3
Impact
5.8
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction Required
Scope Changed
Confidentiality High
Integrity High
Availability None

Threat Intelligence

EPSS Exploit Probability
19.5% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 3

VendorProductVersionRange
seafileseafile_server* <12.0.20
seafileseafile_server13.0.15any
seafileseafile_server13.0.16any

References 6

  • gist.github.com https://gist.github.com/gabdevele/1b7e30ab367b26042fa32f45aa12ce2f
    ExploitThird Party Advisory
  • github.com https://github.com/haiwen/seadoc-editor/commit/8fa988aaede072b2ae073d1b2edcb2fc691423b2
    Patch
  • github.com https://github.com/haiwen/seahub/commit/4c5301747bdb84c64b2f2b3230417df2d1cc8987
    Patch
  • manual.seafile.com https://manual.seafile.com/12.0/changelog/changelog-for-seafile-professional-server/
    Release Notes
  • manual.seafile.com https://manual.seafile.com/13.0/changelog/changelog-for-seafile-professional-server/
    Release Notes
  • manual.seafile.com https://manual.seafile.com/13.0/changelog/server-changelog/
    Release Notes

Remediation

  • github.com https://github.com/haiwen/seadoc-editor/commit/8fa988aaede072b2ae073d1b2edcb2fc691423b2
    Patch
  • github.com https://github.com/haiwen/seahub/commit/4c5301747bdb84c64b2f2b3230417df2d1cc8987
    Patch