Junglewise Threat Intelligence

CVE-2026-30587: Multiple Stored XSS vulnerabilities exist in Seafile Server version 13.0.15,13.0.16-pro,12.0.14 and prior and fixed in 13.0.17, 13.0.17-pro

CVE-2026-30587 · Severity: high · CVSS 8.7 · Published 2026-03-25

Executive brief

Seafile Server, a file hosting and collaboration platform, contains vulnerabilities in its Seadoc document editor. An attacker with a standard user account can inject malicious scripts into shared documents by manipulating background communication messages. If another user or an administrator opens the compromised document, the script can automatically execute, potentially allowing the attacker to steal sensitive data or create unauthorized administrator accounts.

Technical details

Multiple Stored Cross-Site Scripting (XSS) vulnerabilities exist in the Seadoc (sdoc) editor component of Seafile Server. The root cause is a failure to properly sanitize WebSocket messages during document structure updates, allowing attackers to bypass frontend restrictions. Specifically, attackers can inject 'javascript:' URIs into the 'src' attribute of embedded Excalidraw whiteboards (triggering on document load) or the 'href' attribute of anchor tags (triggering on click). An authenticated attacker can exploit this by intercepting and modifying WebSocket frames to store malicious payloads. Successful exploitation can lead to session hijacking, data exfiltration, or privilege escalation if an administrator views the document. The issue is fixed in versions 13.0.17, 13.0.17-pro, and 12.0.20-pro.

Affected products

  • Seafile Seafile Server Professional Edition <= 12.0.19, 13.0.16-pro
  • Seafile Seafile Server Community Edition <= 13.0.15, <= 12.0.14

Timeline

  • 2026-01-31: patched: Fixes merged into seadoc-editor repository.
  • 2026-02-03: patched: Seafile Professional Server 12.0.20 released with fixes.
  • 2026-03-25: advisory: CVE-2026-30587 published.

References