PT-2026-28073 · Seafile+2 · Seafile+2

Gabdevele · Published 2026-03-25 · Updated 2026-03-25 · CVE-2026-30587

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Seafile versions prior to 13.0.17 Seafile versions prior to 13.0.17-pro Seafile versions prior to 12.0.20-pro Seafile versions 13.0.15 through 13.0.16-pro Seafile versions 12.0.14 and earlier

Description The application does not properly sanitize WebSocket messages related to document structure updates within the Seadoc (sdoc) editor. This allows authenticated remote attackers to inject malicious JavaScript payloads through the src attribute of embedded Excalidraw whiteboards or the href attribute of anchor tags.

Recommendations Update to Seafile version 13.0.17. Update to Seafile version 13.0.17-pro. Update to Seafile version 12.0.20-pro.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-30587

GHSA-RQJ3-X344-QVXC

Affected Products

Excalidraw

Seadoc

Seafile

References · 9

• 🔥 https://gist.github.com/gabdevele/1b7e30ab367b26042fa32f45aa12ce2f · Exploit
• https://github.com/haiwen/seahub/commit/4c5301747bdb84c64b2f2b3230417df2d1cc8987 · Patch
• https://github.com/haiwen/seadoc-editor/commit/8fa988aaede072b2ae073d1b2edcb2fc691423b2 · Patch
• https://osv.dev/vulnerability/GHSA-rqj3-x344-qvxc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30587 · Security Note
• https://github.com/haiwen/seadoc-editor · Note
• https://manual.seafile.com/13.0/changelog/changelog-for-seafile-professional-server · Note
• https://manual.seafile.com/13.0/changelog/server-changelog · Note
• https://manual.seafile.com/12.0/changelog/changelog-for-seafile-professional-server · Note