Stored XSS Vulnerabilities in Seafile Server Affected Versions
CVE-2026-30587

5.4MEDIUM

Key Information:

Vendor

Seafile Ltd.

Status
Seafile Server
Vendor
CVE Published:
25 March 2026

What is CVE-2026-30587?

Seafile Server has been identified with multiple stored XSS vulnerabilities in versions up to 13.0.16-pro. These issues arise due to insufficient sanitization of WebSocket messages that modify document structures, allowing authenticated attackers to inject harmful JavaScript payloads. This enables potential exploitation through the src attribute of Excalidraw whiteboards or the href attribute of anchor tags, which could compromise user sessions and data integrity. Users are advised to upgrade to the patched versions to secure their applications.

References

https://gist.github.com/gabdevele/1b7e30ab367b26042fa32f4...
https://manual.seafile.com/13.0/changelog/server-changelog/
https://manual.seafile.com/13.0/changelog/changelog-for-s...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.