CVE-2026-30587
- State
- Published
- Severity
- 5.4 Medium
- Published
- Mar 25, 2026
- Updated
- May 10, 2026
- Reserved
- Mar 4, 2026
Description
Multiple Stored XSS vulnerabilities exist in Seafile Server version 13.0.15,13.0.16-pro,12.0.14 and prior and fixed in 13.0.17, 13.0.17-pro, and 12.0.20-pro, via the Seadoc (sdoc) editor. The application fails to properly sanitize WebSocket messages regarding document structure updates. This allows authenticated remote attackers to inject malicious JavaScript payloads via the src attribute of embedded Excalidraw whiteboards or the href attribute of anchor tags
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.4 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N | CISA-ADP |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- https://gist.github.com/gabdevele/1b7e30ab367b26042fa32f45aa12ce2f
- https://manual.seafile.com/13.0/changelog/server-changelog/
- https://manual.seafile.com/13.0/changelog/changelog-for-seafile-professional-server/
- https://manual.seafile.com/12.0/changelog/changelog-for-seafile-professional-server/
- https://github.com/haiwen/seahub/commit/4c5301747bdb84c64b2f2b3230417df2d1cc8987
- https://github.com/haiwen/seadoc-editor/commit/8fa988aaede072b2ae073d1b2edcb2fc691423b2
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.