PT-2026-28073 · Seafile+2 · Seafile+2

Gabdevele · Publicado 2026-03-25 · Atualizado 2026-03-25 · CVE-2026-30587

Positive Technologies (AI Summary)

CVSS v3.1

8.7

Alta

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Seafile versions prior to 13.0.17 Seafile versions prior to 13.0.17-pro Seafile versions prior to 12.0.20-pro Seafile versions 13.0.15 through 13.0.16-pro Seafile versions 12.0.14 and earlier

Description The application does not properly sanitize WebSocket messages related to document structure updates within the Seadoc (sdoc) editor. This allows authenticated remote attackers to inject malicious JavaScript payloads through the src attribute of embedded Excalidraw whiteboards or the href attribute of anchor tags.

Recommendations Update to Seafile version 13.0.17. Update to Seafile version 13.0.17-pro. Update to Seafile version 12.0.20-pro.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-30587

GHSA-RQJ3-X344-QVXC

Produtos afetados

Excalidraw

Seadoc

Seafile

Referências · 9

• 🔥 https://gist.github.com/gabdevele/1b7e30ab367b26042fa32f45aa12ce2f · Exploit
• https://github.com/haiwen/seahub/commit/4c5301747bdb84c64b2f2b3230417df2d1cc8987 · Correção
• https://github.com/haiwen/seadoc-editor/commit/8fa988aaede072b2ae073d1b2edcb2fc691423b2 · Correção
• https://github.com/haiwen/seadoc-editor · Nota
• https://manual.seafile.com/13.0/changelog/changelog-for-seafile-professional-server · Nota
• https://manual.seafile.com/13.0/changelog/server-changelog · Nota
• https://manual.seafile.com/12.0/changelog/changelog-for-seafile-professional-server · Nota
• https://osv.dev/vulnerability/GHSA-rqj3-x344-qvxc · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-30587 · Nota de Segurança