169 matches found
CVE-2021-30146
CVE-2021-30146 Seafile 7.0.5 Persistent XSS Suggested description: Application Server Version: 7.0.5 Seafile is vulnerable to Persistent XSS via share library functionality. Additional Information: Seafile is an open source, self-hosted file sync and share solution with high performance and...
EUVD-2026-125600
Seafile SeaDoc converter 2.0.4 before 2.0.11 and 3.0.0 before 3.0.8 contains an absolute path traversal vulnerability that allows unauthenticated attackers holding a public share token to execute code. Attackers supply an absolute filename to /api/v1/confluence-to-wiki/ to extract a ZIP from...
CVE-2026-129167 SeaDoc converter 2.0.4 before 2.0.11 and 3.0.0 before 3.0.8 Path Traversal RCE via confluence-to-wiki
Seafile SeaDoc converter 2.0.4 before 2.0.11 and 3.0.0 before 3.0.8 contains an absolute path traversal vulnerability that allows unauthenticated attackers holding a public share token to execute code. Attackers supply an absolute filename to /api/v1/confluence-to-wiki/ to extract a ZIP from...
PT-2026-147023
Name of the Vulnerable Software and Affected Versions Seafile SeaDoc converter versions 2.0.4 through 2.0.10 Seafile SeaDoc converter versions 3.0.0 through 3.0.7 Description An absolute path traversal issue exists that allows unauthenticated attackers with a public share token to execute code. A...
CVE-2026-121927
A vulnerability has been found in InfiniFlow RAGFlow up to 0.27.3. Affected by this issue is the function accountget of the file common/datasource/seafileconnector.py of the component Seafile Connector. Such manipulation of the argument seafileurl leads to server-side request forgery. The attack...
EUVD-2026-117009
A vulnerability has been found in InfiniFlow RAGFlow up to 0.27.3. Affected by this issue is the function accountget of the file common/datasource/seafileconnector.py of the component Seafile Connector. Such manipulation of the argument seafileurl leads to server-side request forgery. The attack...
CVE-2026-121927 InfiniFlow RAGFlow Seafile Connector seafile_connector.py _account_get server-side request forgery
A vulnerability has been found in InfiniFlow RAGFlow up to 0.27.3. Affected by this issue is the function accountget of the file common/datasource/seafileconnector.py of the component Seafile Connector. Such manipulation of the argument seafileurl leads to server-side request forgery. The attack...
CVE-2026-121927
A Server-Side Request Forgery (SSRF) vulnerability exists in InfiniFlow RAGFlow versions up to 0.27.3 . The flaw is located within the Seafile Connector component, specifically in the _account_get function of the common/data_source/seafile_connector.py file. An attacker can achieve remote executi...
Seafile out-of-bounds read on malformed head commit ID
Seafile out-of-bounds read on malformed head commit ID Vulnerability Overview When the Seafile client daemon checks the remote head commit, it parses the head commit ID from the server response and copies it into the destination buffer at a fixed length 40 bytes; Seafile commit IDs are 40...
Seafile server-controlled sync path can escape the client worktree (macOS/Linux)
Seafile server-controlled sync path can escape the client worktree macOS/Linux Vulnerability Overview The Seafile client's sync module applies file diffs delivered by the server during the checkout phase, and the target path of rename operations is fully controlled by the server. The validity che...
Seafile Panel - Detect
Seafile panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Seafile panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Seafile Panel - Detect', 'description': 'Seafile panel was...
Seafile API - Detect
Seafile API was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Seafile API was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Seafile API - Detect', 'description': 'Seafile API was detected.',...
Seafile - Public Registration Enabled Detection
Detected public user registration is enabled on a Seafile instance. !/usr/bin/env python3 -- coding: utf-8 -- """Detected public user registration is enabled on a Seafile instance.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: inf...
SUSE CVE-2026-30587
Multiple Stored XSS vulnerabilities exist in Seafile Server version 13.0.15,13.0.16-pro,12.0.14 and prior and fixed in 13.0.17, 13.0.17-pro, and 12.0.20-pro, via the Seadoc sdoc editor. The application fails to properly sanitize WebSocket messages regarding document structure updates. This allows...
CVE-2026-30587
A flaw was found in Seafile Server and its Seadoc editor. This Stored Cross-Site Scripting XSS vulnerability allows authenticated remote attackers to inject malicious JavaScript code. The application fails to properly sanitize WebSocket messages during document structure updates. By exploiting...
GHSA-RQJ3-X344-QVXC Seafile Server has multiple stored XSS vulnerabilities
Multiple Stored XSS vulnerabilities exist in Seafile Server version 13.0.15,13.0.16-pro,12.0.14 and prior and fixed in 13.0.17, 13.0.17-pro, and 12.0.20-pro, via the Seadoc sdoc editor. The application fails to properly sanitize WebSocket messages regarding document structure updates. This allows...
Seafile Server has multiple stored XSS vulnerabilities
Multiple Stored XSS vulnerabilities exist in Seafile Server version 13.0.15,13.0.16-pro,12.0.14 and prior and fixed in 13.0.17, 13.0.17-pro, and 12.0.20-pro, via the Seadoc sdoc editor. The application fails to properly sanitize WebSocket messages regarding document structure updates. This allows...
EUVD-2026-15940
Multiple Stored XSS vulnerabilities exist in Seafile Server version 13.0.15,13.0.16-pro,12.0.14 and prior and fixed in 13.0.17, 13.0.17-pro, and 12.0.20-pro, via the Seadoc sdoc editor. The application fails to properly sanitize WebSocket messages regarding document structure updates. This allows...
CVE-2026-30587
Multiple Stored XSS vulnerabilities exist in Seafile Server version 13.0.15,13.0.16-pro,12.0.14 and prior and fixed in 13.0.17, 13.0.17-pro, and 12.0.20-pro, via the Seadoc sdoc editor. The application fails to properly sanitize WebSocket messages regarding document structure updates. This allows...
CVE-2026-30587
CVE-2026-30587 affects Seafile Server and its Seadoc editor, with multiple stored XSS vulnerabilities exploited via WebSocket messages that update document structure. Affected versions include 13.0.15, 13.0.16-pro, and 12.0.14 and prior; fixes are in 13.0.17, 13.0.17-pro, and 12.0.20-pro. The iss...