CVE-2026-30587

Multiple Stored XSS vulnerabilities exist in Seafile Server version 13.0.15,13.0.16-pro,12.0.14 and prior and fixed in 13.0.17, 13.0.17-pro, and 12.0.20-pro, via the Seadoc (sdoc) editor. The application fails to properly sanitize WebSocket messages regarding document structure updates. This allows authenticated remote attackers to inject malicious JavaScript payloads via the src attribute of embedded Excalidraw whiteboards or the href attribute of anchor tags

CVSS v3 8.7 HIGH

8.7^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.3 / Impact : 5.8

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://gist.github.com/gabdevele/1b7e30ab367b26042fa32f45aa12ce2f	Exploit Third Party Advisory
https://github.com/haiwen/seadoc-editor/commit/8fa988aaede072b2ae073d1b2edcb2fc691423b2	Patch
https://github.com/haiwen/seahub/commit/4c5301747bdb84c64b2f2b3230417df2d1cc8987	Patch
https://manual.seafile.com/12.0/changelog/changelog-for-seafile-professional-server/	Release Notes
https://manual.seafile.com/13.0/changelog/changelog-for-seafile-professional-server/	Release Notes
https://manual.seafile.com/13.0/changelog/server-changelog/	Release Notes

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:seafile:seafile_server:::::professional:::*
	cpe:2.3:a:seafile:seafile_server:13.0.15::::community:::
	cpe:2.3:a:seafile:seafile_server:13.0.16::::professional:::

History

No history.

Information

Published : 2026-03-25 18:16

Updated : 2026-06-17 10:32

NVD link : CVE-2026-30587

Mitre link : CVE-2026-30587

CVE.ORG link : CVE-2026-30587

JSON object : View

Products Affected

seafile

seafile_server

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-30587", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-30587", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-27T19:39:14.665567Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 2.3}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-03-25T18:16:31.793", "references": [{"url": "https://gist.github.com/gabdevele/1b7e30ab367b26042fa32f45aa12ce2f", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/haiwen/seadoc-editor/commit/8fa988aaede072b2ae073d1b2edcb2fc691423b2", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "https://github.com/haiwen/seahub/commit/4c5301747bdb84c64b2f2b3230417df2d1cc8987", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "https://manual.seafile.com/12.0/changelog/changelog-for-seafile-professional-server/", "tags": ["Release Notes"], "source": "cve@mitre.org"}, {"url": "https://manual.seafile.com/13.0/changelog/changelog-for-seafile-professional-server/", "tags": ["Release Notes"], "source": "cve@mitre.org"}, {"url": "https://manual.seafile.com/13.0/changelog/server-changelog/", "tags": ["Release Notes"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Multiple Stored XSS vulnerabilities exist in Seafile Server version 13.0.15,13.0.16-pro,12.0.14 and prior and fixed in 13.0.17, 13.0.17-pro, and 12.0.20-pro, via the Seadoc (sdoc) editor. The application fails to properly sanitize WebSocket messages regarding document structure updates. This allows authenticated remote attackers to inject malicious JavaScript payloads via the src attribute of embedded Excalidraw whiteboards or the href attribute of anchor tags"}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de XSS Almacenado existen en Seafile Servidor versi\u00f3n 13.0.15, 13.0.16-pro, 12.0.14 y anteriores, y fueron corregidas en 13.0.17, 13.0.17-pro y 12.0.20-pro, a trav\u00e9s del editor Seadoc (sdoc). La aplicaci\u00f3n no logra sanear correctamente los mensajes de WebSocket relacionados con las actualizaciones de la estructura del documento. Esto permite a atacantes remotos autenticados inyectar cargas \u00fatiles maliciosas de JavaScript a trav\u00e9s del atributo src de las pizarras blancas incrustadas de Excalidraw o el atributo href de las etiquetas de anclaje."}], "lastModified": "2026-06-17T10:32:49.470", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:seafile:seafile_server:*:*:*:*:professional:*:*:*", "vulnerable": true, "matchCriteriaId": "79197CA1-6A7E-4165-AD57-982C8824B82C", "versionEndExcluding": "12.0.20"}, {"criteria": "cpe:2.3:a:seafile:seafile_server:13.0.15:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "ECCCED4B-9663-4BC1-BD35-995B3DCDAC95"}, {"criteria": "cpe:2.3:a:seafile:seafile_server:13.0.16:*:*:*:professional:*:*:*", "vulnerable": true, "matchCriteriaId": "880080C5-9A1A-4D9B-83AB-33D8C21FCF38"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}