CVE-2026-30587

Katalog CVE

CVSS 8.7 · High EPSS 0,46%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada seafile server. Skor CVSS 3.1 8.7 (High) menurut NVD.

Deskripsi (NVD)

Multiple Stored XSS vulnerabilities exist in Seafile Server version 13.0.15,13.0.16-pro,12.0.14 and prior and fixed in 13.0.17, 13.0.17-pro, and 12.0.20-pro, via the Seadoc (sdoc) editor. The application fails to properly sanitize WebSocket messages regarding document structure updates. This allows authenticated remote attackers to inject malicious JavaScript payloads via the src attribute of embedded Excalidraw whiteboards or the href attribute of anchor tags

Rincian

Terbit di NVD

25 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.7 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,46% peluang dieksploitasi; lebih tinggi dari 37,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/haiwen/seadoc-editor/commit/8fa988aaede072b2ae073d1b2edcb2fc691423b2 patch
• https://github.com/haiwen/seahub/commit/4c5301747bdb84c64b2f2b3230417df2d1cc8987 patch
• https://gist.github.com/gabdevele/1b7e30ab367b26042fa32f45aa12ce2f exploit · advisory pihak ketiga
• https://manual.seafile.com/12.0/changelog/changelog-for-seafile-professional-server/ release notes
• https://manual.seafile.com/13.0/changelog/changelog-for-seafile-professional-server/ release notes
• https://manual.seafile.com/13.0/changelog/server-changelog/ release notes