CVE-2026-30587

[CVE catalog]

Severity

High · CVSS 8.7

Published

Mar 25, 2026, 12:00:00 AM UTC

Source

[NVD] · [CVE record]

EPSS

0.29% · Oct 25, 2026

A flaw was found in Seafile Server and its Seadoc editor. This Stored Cross-Site Scripting (XSS) vulnerability allows authenticated remote attackers to inject malicious JavaScript code. The application fails to properly sanitize WebSocket messages during document structure updates. By exploiting this, an attacker can execute arbitrary client-side scripts, potentially leading to information disclosure or unauthorized actions within a user's browser. This MODERATE stored XSS vulnerability in Seafile Server's Seadoc editor allows authenticated users to inject malicious scripts via unsanitized WebSocket messages. Exploitation requires low privileges (any authenticated user) and user interaction (victim views document). Impact is high to confidentiality and integrity. Affects Seafile Server 13.0.15, 13.0.16-pro, 12.0.14 and prior. Fixed in 13.0.17, 13.0.17-pro, and 12.0.20-pro. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.