Security readout for executives and security teams
Plain-English summary
Seafile Server, a self-hosted file sharing platform, has a flaw in its built-in document editor that lets a logged-in user plant hidden malicious code inside a document. When a coworker opens that document, the code can run in their browser and act as them. The vendor has released fixes that organizations should install.
Executive priority
Medium priority. Patch within the normal maintenance cycle, prioritizing instances exposed to external or guest users. No evidence of active exploitation, but the flaw enables session hijacking of collaborators inside a trusted document tool, which can expand impact across shared libraries.
Technical view
Multiple stored cross-site scripting (CWE-79) issues exist in the Seadoc (sdoc) editor of Seafile Server versions 13.0.15, 13.0.16-pro, 12.0.14, and prior. The application does not sanitize WebSocket messages used for document structure updates, allowing authenticated attackers to inject JavaScript through the src attribute of embedded Excalidraw whiteboards or the href attribute of anchor tags. Fixes shipped in 13.0.17, 13.0.17-pro, and 12.0.20-pro.
Likely exposure
Affects Seafile Server deployments running 13.0.15, 13.0.16-pro, 12.0.14, or earlier where the Seadoc editor is in use. Exposure is highest for instances with many authenticated collaborators, shared document libraries, or external/guest users who can author or edit sdoc documents. Internet-facing instances broaden reach but exploitation still requires an authenticated account.
Exploitation context
CVSS 3.1 base 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Sources do not show active exploitation and the CVE is not in CISA KEV. Successful abuse requires an authenticated user to craft a malicious sdoc document and a victim user to open it, after which injected JavaScript runs in the victim's browser session.
Researcher notes
Stored XSS sinks are the src attribute of embedded Excalidraw whiteboards and the href attribute of anchor tags inside sdoc documents, delivered via unsanitized WebSocket document-structure updates. The seahub commit 4c530174 and seadoc-editor commit 8fa988aa show the sanitization fixes; diff them to derive safe attribute allow-lists. Scope is CVSS Scoped (S:C), reflecting impact beyond the sdoc component into the broader Seafile web session.
Mitigation direction
- Upgrade Seafile Server to 13.0.17, 13.0.17-pro, or 12.0.20-pro per vendor changelogs.
- Restrict document creation and sharing permissions to trusted internal users until patched.
- Review and tighten guest/external account access to Seadoc-enabled libraries.
- Enforce strong Content Security Policy and session controls on the Seafile web interface.
- Monitor Seafile audit logs for unusual sdoc edits or anchor/Excalidraw embeds.
- Communicate the update window to collaborators and confirm post-upgrade version banner.
Validation and detection
- Confirm running Seafile version against the fixed builds 13.0.17, 13.0.17-pro, or 12.0.20-pro.
- Review the linked seahub and seadoc-editor commits to verify sanitization changes are present.
- Inventory user accounts with sdoc edit rights and quantify external collaborators.
- After patching, test that anchor href and Excalidraw src attributes reject javascript: and HTML payloads.
- Inspect recent sdoc documents for suspicious anchor or embedded whiteboard content.
- Validate browser session protections (HttpOnly, SameSite) on Seafile auth cookies.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-30587 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N2.32.7CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.4MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://gist.github.com/gabdevele/1b7e30ab367b26042fa32f45aa12ce2fCVE reference, mitre
- https://manual.seafile.com/13.0/changelog/server-changelog/CVE reference, mitre
- https://manual.seafile.com/13.0/changelog/changelog-for-seafile-professional-server/CVE reference, mitre
- https://manual.seafile.com/12.0/changelog/changelog-for-seafile-professional-server/CVE reference, mitre
- https://github.com/haiwen/seahub/commit/4c5301747bdb84c64b2f2b3230417df2d1cc8987CVE reference, mitre
- https://github.com/haiwen/seadoc-editor/commit/8fa988aaede072b2ae073d1b2edcb2fc691423b2CVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.