CVE-2021-30146

CVE-2021-30146 Seafile 7.0.5 Persistent XSS Suggested description: Application Server Version: 7.0.5 Seafile is vulnerable to Persistent XSS via share library functionality. Additional Information: Seafile is an open source, self-hosted file sync and share solution with high performance and...

Seafile out-of-bounds read on malformed head commit ID

Seafile out-of-bounds read on malformed head commit ID Vulnerability Overview When the Seafile client daemon checks the remote head commit, it parses the head commit ID from the server response and copies it into the destination buffer at a fixed length 40 bytes; Seafile commit IDs are 40...

Seafile server-controlled sync path can escape the client worktree (macOS/Linux)

Seafile server-controlled sync path can escape the client worktree macOS/Linux Vulnerability Overview The Seafile client's sync module applies file diffs delivered by the server during the checkout phase, and the target path of rename operations is fully controlled by the server. The validity che...

Seafile - Public Registration Enabled Detection

Detected public user registration is enabled on a Seafile instance. !/usr/bin/env python3 -- coding: utf-8 -- """Detected public user registration is enabled on a Seafile instance.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: inf...

Seafile API - Detect

Seafile API was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Seafile API was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Seafile API - Detect', 'description': 'Seafile API was detected.',...

Seafile Panel - Detect

Seafile panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Seafile panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Seafile Panel - Detect', 'description': 'Seafile panel was...

SUSE CVE-2026-30587

Multiple Stored XSS vulnerabilities exist in Seafile Server version 13.0.15,13.0.16-pro,12.0.14 and prior and fixed in 13.0.17, 13.0.17-pro, and 12.0.20-pro, via the Seadoc sdoc editor. The application fails to properly sanitize WebSocket messages regarding document structure updates. This allows...

CVE-2026-30587

A flaw was found in Seafile Server and its Seadoc editor. This Stored Cross-Site Scripting XSS vulnerability allows authenticated remote attackers to inject malicious JavaScript code. The application fails to properly sanitize WebSocket messages during document structure updates. By exploiting...

@seafile/sdoc-editor (>=2.0.60, <=2.0.61), @seafile/seafile-sdoc-editor (>=2.0.0, <=2.0.45-test-0.0.4) +1 more potentially affected by CVE-2026-30587 via @seafile/sdoc-editor (>=2.0.59, <=2.0.128-test-0.0.2)

@seafile/sdoc-editor NPM version =2.0.59, =2.0.60, =2.0.0, =1.0.2, =6.0.35 Source cves: CVE-2026-30587 Source advisory: OSV:GHSA-RQJ3-X344-QVXC...

EUVD-2026-15940

Multiple Stored XSS vulnerabilities exist in Seafile Server version 13.0.15,13.0.16-pro,12.0.14 and prior and fixed in 13.0.17, 13.0.17-pro, and 12.0.20-pro, via the Seadoc sdoc editor. The application fails to properly sanitize WebSocket messages regarding document structure updates. This allows...

Seafile Server has multiple stored XSS vulnerabilities

Multiple Stored XSS vulnerabilities exist in Seafile Server version 13.0.15,13.0.16-pro,12.0.14 and prior and fixed in 13.0.17, 13.0.17-pro, and 12.0.20-pro, via the Seadoc sdoc editor. The application fails to properly sanitize WebSocket messages regarding document structure updates. This allows...

GHSA-RQJ3-X344-QVXC Seafile Server has multiple stored XSS vulnerabilities

Multiple Stored XSS vulnerabilities exist in Seafile Server version 13.0.15,13.0.16-pro,12.0.14 and prior and fixed in 13.0.17, 13.0.17-pro, and 12.0.20-pro, via the Seadoc sdoc editor. The application fails to properly sanitize WebSocket messages regarding document structure updates. This allows...

@seafile/sdoc-editor (>=2.0.60, <=2.0.61), @seafile/seafile-sdoc-editor (>=2.0.0, <=2.0.45-test-0.0.4) +1 more potentially affected by CVE-2026-30587 via @seafile/sdoc-editor (>=2.0.59, <=2.0.128-test-0.0.2)

@seafile/sdoc-editor NPM version =2.0.59, =2.0.60, =2.0.0, =1.0.2, =6.0.35 Source cves: CVE-2026-30587 Source advisory: GHSA-RQJ3-X344-QVXC...

CVE-2026-30587

Multiple Stored XSS vulnerabilities exist in Seafile Server version 13.0.15,13.0.16-pro,12.0.14 and prior and fixed in 13.0.17, 13.0.17-pro, and 12.0.20-pro, via the Seadoc sdoc editor. The application fails to properly sanitize WebSocket messages regarding document structure updates. This allows...

CVE-2026-30587

Multiple Stored XSS vulnerabilities exist in Seafile Server version 13.0.15,13.0.16-pro,12.0.14 and prior and fixed in 13.0.17, 13.0.17-pro, and 12.0.20-pro, via the Seadoc sdoc editor. The application fails to properly sanitize WebSocket messages regarding document structure updates. This allows...

CVE-2026-30587

CVE-2026-30587 affects Seafile Server and its Seadoc editor, with multiple stored XSS vulnerabilities exploited via WebSocket messages that update document structure. Affected versions include 13.0.15, 13.0.16-pro, and 12.0.14 and prior; fixes are in 13.0.17, 13.0.17-pro, and 12.0.20-pro. The iss...

CVE-2026-30587

Multiple Stored XSS vulnerabilities exist in Seafile Server version 13.0.15,13.0.16-pro,12.0.14 and prior and fixed in 13.0.17, 13.0.17-pro, and 12.0.20-pro, via the Seadoc sdoc editor. The application fails to properly sanitize WebSocket messages regarding document structure updates. This allows...

PT-2026-28073

Multiple Stored XSS vulnerabilities exist in Seafile Server version 13.0.15,13.0.16-pro,12.0.14 and prior and fixed in 13.0.17, 13.0.17-pro, and 12.0.20-pro, via the Seadoc sdoc editor. The application fails to properly sanitize WebSocket messages regarding document structure updates. This allows...

CVE-2026-30587

Multiple Stored XSS vulnerabilities exist in Seafile Server version 13.0.15,13.0.16-pro,12.0.14 and prior and fixed in 13.0.17, 13.0.17-pro, and 12.0.20-pro, via the Seadoc sdoc editor. The application fails to properly sanitize WebSocket messages regarding document structure updates. This allows...

CVE-2026-30587

Multiple Stored XSS vulnerabilities exist in Seafile Server version 13.0.15,13.0.16-pro,12.0.14 and prior and fixed in 13.0.17, 13.0.17-pro, and 12.0.20-pro, via the Seadoc sdoc editor. The application fails to properly sanitize WebSocket messages regarding document structure updates. This allows...