Medium 5.4Published Mar 24, 2026

CVE-2026-30587Multiple Stored XSS vulnerabilities exist in Seafile Server version 13.0.15,13.0.16-pro,12.0.14 and prior and fixed in 13.0.17, 13.0.17-pro, and 12.0.20-pro, via the Seadoc (sdoc) editor.

Updated under an hour ago (Oct 26, 2026, 7:00 AM ET)

Does this affect you?

It affects seafile_server. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for seafile_server

Exploited in the last 30 days

Multiple Stored XSS vulnerabilities exist in Seafile Server version 13.0.15,13.0.16-pro,12.0.14 and prior and fixed in 13.0.17, 13.0.17-pro, and 12.0.20-pro, via the Seadoc (sdoc) editor. The application fails to properly sanitize WebSocket messages regarding document structure updates. This allows authenticated remote attackers to inject malicious JavaScript payloads via the src attribute of embedded Excalidraw whiteboards or the href attribute of anchor tags

CVSS: 5.4 MEDIUM (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness (CWE): CWE-79
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: mitre
NVD analysis: Modified
Record last updated: May 10, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

seafile seafile_server seafile:seafile_server	before 12.0.20; 13.0.15; 13.0.16	NVD

References

https://gist.github.com/gabdevele/1b7e30ab367b26042fa32f45aa12ce2fexploit, third-party-advisory
https://manual.seafile.com/13.0/changelog/server-changelog/release-notes
https://manual.seafile.com/13.0/changelog/changelog-for-seafile-professional-server/release-notes
https://manual.seafile.com/12.0/changelog/changelog-for-seafile-professional-server/release-notes
https://github.com/haiwen/seahub/commit/4c5301747bdb84c64b2f2b3230417df2d1cc8987patch
https://github.com/haiwen/seadoc-editor/commit/8fa988aaede072b2ae073d1b2edcb2fc691423b2patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.