Absolute Path Traversal Vulnerability in Seafile SeaDoc Converter

CVE-2026-129167

What is CVE-2026-129167?

The Seafile SeaDoc Converter versions 2.0.4 prior to 2.0.11 and 3.0.0 prior to 3.0.8 are susceptible to an absolute path traversal vulnerability. This flaw allows unauthenticated attackers with a valid public share token to execute arbitrary code. By providing an absolute filename through the /api/v1/confluence-to-wiki/ interface, attackers can extract a ZIP file to the Python library path, potentially leading to unauthorized code execution via a file-convert request. It is essential to apply the necessary updates to mitigate the risk of exploitation.

References