CVE Feed

    Dashboard / CVE / CVE-2026-30587

    CVE-2026-30587

    Multiple Stored XSS vulnerabilities exist in Seafile Server version 13.0.15,13.0.16-pro,12.0.14 and prior and fixed in 13.0.17, 13.0.17-pro, and 12.0.20-pro, via the Seadoc (sdoc) editor. The application fails to properly sanitize WebSocket messages regarding document structure updates. This allows authenticated remote attackers to inject malicious JavaScript payloads via the src attribute of embedded Excalidraw whiteboards or the href attribute of anchor tags

    Published:Mar 25, 2026
    Last Modified:Apr 2, 2026
    EPS:Mar 25, 2026
    EPSS Score:0.00049
    CVSS Score:5.4

    Affected Products

    Vendor
    Seafile
    Product
    Seafile
    Vendor
    Seafile
    Product
    Seafile Server

    Exploits

    https://gist.github.com/gabdevele/1b7e30ab367b26042fa32f45aa12ce2f

    Related CVEs

    CVE-2025-41080 (CVSS 5.1) — A stored Cross-Site Scripting (XSS) vulnerability has been found in Seafile v12.0.10. This vulnerability allow…
    CVE-2025-41079 (CVSS 5.1) — A stored Cross-Site Scripting (XSS) vulnerability has been found in Seafile v12.0.10. This vulnerability allow…
    CVE-2025-65516 (CVSS 6.1) — A stored cross-site scripting (XSS) vulnerability was discovered in Seafile Community Edition prior to version…
    CVE-2025-45091 (CVSS 5.4) — Seafile versions 11.0.18-Pro, 12.0.10, and 12.0.10-Pro are vulnerable to a stored Cross-Site Scripting (XSS) a…
    CVE-2023-28873 (CVSS 5.4) — An XSS issue in wiki and discussion pages in Seafile 9.0.6 allows attackers to inject JavaScript into the Mark…
    CVE-2023-28874 (CVSS 6.1) — The next parameter in the /accounts/login endpoint of Seafile 9.0.6 allows attackers to redirect users to arbi…
    CVE-2021-30146 (CVSS 5.4) — Seafile 7.0.5 (2019) allows Persistent XSS via the "share of library functionality."…
    CVE-2013-7469 (CVSS 7.5) — Seafile through 6.2.11 always uses the same Initialization Vector (IV) with Cipher Block Chaining (CBC) Mode t…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High