{"id":"CVE-2026-30587","details":"Multiple Stored XSS vulnerabilities exist in Seafile Server version 13.0.15,13.0.16-pro,12.0.14 and prior and fixed in 13.0.17, 13.0.17-pro, and 12.0.20-pro, via the Seadoc (sdoc) editor. The application fails to properly sanitize WebSocket messages regarding document structure updates. This allows authenticated remote attackers to inject malicious JavaScript payloads via the src attribute of embedded Excalidraw whiteboards or the href attribute of anchor tags","aliases":["GHSA-rqj3-x344-qvxc"],"modified":"2026-07-15T01:49:03.100524832Z","published":"2026-03-25T00:00:00Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30587.json","cna_assigner":"mitre"},"references":[{"type":"WEB","url":"https://gist.github.com/gabdevele/1b7e30ab367b26042fa32f45aa12ce2f"},{"type":"WEB","url":"https://manual.seafile.com/12.0/changelog/changelog-for-seafile-professional-server/"},{"type":"WEB","url":"https://manual.seafile.com/13.0/changelog/changelog-for-seafile-professional-server/"},{"type":"WEB","url":"https://manual.seafile.com/13.0/changelog/server-changelog/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30587.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30587"},{"type":"FIX","url":"https://github.com/haiwen/seadoc-editor/commit/8fa988aaede072b2ae073d1b2edcb2fc691423b2"},{"type":"FIX","url":"https://github.com/haiwen/seahub/commit/4c5301747bdb84c64b2f2b3230417df2d1cc8987"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/haiwen/seadoc-editor","events":[{"introduced":"0"},{"fixed":"8fa988aaede072b2ae073d1b2edcb2fc691423b2"}],"database_specific":{"source":"REFERENCES"}}],"versions":["@seafile/seafile-sdoc-editor@3.0.74","@seafile/sdoc-editor@3.0.74","@seafile/seafile-sdoc-editor@3.0.73","@seafile/sdoc-editor@3.0.73","@seafile/seafile-sdoc-editor@3.0.72","@seafile/sdoc-editor@3.0.72","@seafile/seafile-sdoc-editor@3.0.71","@seafile/sdoc-editor@3.0.71","@seafile/seafile-sdoc-editor@3.0.70","@seafile/sdoc-editor@3.0.70","@seafile/seafile-sdoc-editor@3.0.69","@seafile/sdoc-editor@3.0.69","@seafile/seafile-sdoc-editor@3.0.68","@seafile/sdoc-editor@3.0.68","@seafile/seafile-sdoc-editor@3.0.67","@seafile/sdoc-editor@3.0.67","@seafile/seafile-sdoc-editor@3.0.66","@seafile/sdoc-editor@3.0.66","@seafile/seafile-sdoc-editor@3.0.65","@seafile/sdoc-editor@3.0.65","@seafile/seafile-sdoc-editor@3.0.64","@seafile/sdoc-editor@3.0.64","@seafile/seafile-sdoc-editor@3.0.63","@seafile/sdoc-editor@3.0.63","@seafile/seafile-sdoc-editor@3.0.62","@seafile/sdoc-editor@3.0.62","@seafile/seafile-sdoc-editor@3.0.61","@seafile/sdoc-editor@3.0.61","@seafile/seafile-sdoc-editor@3.0.60","@seafile/sdoc-editor@3.0.60","@seafile/seafile-sdoc-editor@3.0.59","@seafile/sdoc-editor@3.0.59","@seafile/seafile-sdoc-editor@3.0.58","@seafile/sdoc-editor@3.0.58","@seafile/seafile-sdoc-editor@3.0.57","@seafile/sdoc-editor@3.0.57","@seafile/seafile-sdoc-editor@3.0.56","@seafile/sdoc-editor@3.0.56","@seafile/seafile-sdoc-editor@3.0.55","@seafile/sdoc-editor@3.0.55","@seafile/seafile-sdoc-editor@3.0.54","@seafile/sdoc-editor@3.0.54","@seafile/seafile-sdoc-editor@3.0.53","@seafile/sdoc-editor@3.0.53","@seafile/seafile-sdoc-editor@3.0.52","@seafile/sdoc-editor@3.0.52","@seafile/seafile-sdoc-editor@3.0.51","@seafile/sdoc-editor@3.0.51","@seafile/seafile-sdoc-editor@3.0.50","@seafile/sdoc-editor@3.0.50","@seafile/seafile-sdoc-editor@3.0.49","@seafile/sdoc-editor@3.0.49","@seafile/seafile-sdoc-editor@3.0.48","@seafile/sdoc-editor@3.0.48","@seafile/seafile-sdoc-editor@3.0.47","@seafile/sdoc-editor@3.0.47","@seafile/seafile-sdoc-editor@3.0.46","@seafile/sdoc-editor@3.0.46","@seafile/seafile-sdoc-editor@3.0.45","@seafile/sdoc-editor@3.0.45","@seafile/seafile-sdoc-editor@3.0.44","@seafile/sdoc-editor@3.0.44","@seafile/seafile-sdoc-editor@3.0.43","@seafile/sdoc-editor@3.0.43","@seafile/seafile-sdoc-editor@3.0.42","@seafile/sdoc-editor@3.0.42","@seafile/seafile-sdoc-editor@3.0.41","@seafile/sdoc-editor@3.0.41","@seafile/seafile-sdoc-editor@3.0.40","@seafile/sdoc-editor@3.0.40","@seafile/seafile-sdoc-editor@3.0.39","@seafile/sdoc-editor@3.0.39","@seafile/seafile-sdoc-editor@3.0.38","@seafile/sdoc-editor@3.0.38","@seafile/seafile-sdoc-editor@3.0.37","@seafile/sdoc-editor@3.0.37","@seafile/seafile-sdoc-editor@3.0.36","@seafile/sdoc-editor@3.0.36","@seafile/seafile-sdoc-editor@3.0.35","@seafile/sdoc-editor@3.0.35","@seafile/seafile-sdoc-editor@3.0.34","@seafile/sdoc-editor@3.0.34","@seafile/seafile-sdoc-editor@3.0.33","@seafile/sdoc-editor@3.0.33","@seafile/seafile-sdoc-editor@3.0.32","@seafile/sdoc-editor@3.0.32","@seafile/seafile-sdoc-editor@3.0.31","@seafile/sdoc-editor@3.0.31","@seafile/seafile-sdoc-editor@3.0.30","@seafile/sdoc-editor@3.0.30","@seafile/seafile-sdoc-editor@3.0.29","@seafile/sdoc-editor@3.0.29","@seafile/seafile-sdoc-editor@3.0.28","@seafile/sdoc-editor@3.0.28","@seafile/seafile-sdoc-editor@3.0.27","@seafile/sdoc-editor@3.0.27","@seafile/seafile-sdoc-editor@3.0.26","@seafile/sdoc-editor@3.0.26","@seafile/seafile-sdoc-editor@3.0.25","@seafile/sdoc-editor@3.0.25","@seafile/seafile-sdoc-editor@3.0.24","@seafile/sdoc-editor@3.0.24","@seafile/seafile-sdoc-editor@3.0.23","@seafile/sdoc-editor@3.0.23","@seafile/seafile-sdoc-editor@3.0.22","@seafile/sdoc-editor@3.0.22","@seafile/seafile-sdoc-editor@3.0.21","@seafile/sdoc-editor@3.0.21","@seafile/seafile-sdoc-editor@3.0.20","@seafile/sdoc-editor@3.0.20","@seafile/seafile-sdoc-editor@3.0.19","@seafile/sdoc-editor@3.0.19","@seafile/seafile-sdoc-editor@3.0.18","@seafile/sdoc-editor@3.0.18","@seafile/seafile-sdoc-editor@3.0.17","@seafile/sdoc-editor@3.0.17","@seafile/seafile-sdoc-editor@3.0.16","@seafile/sdoc-editor@3.0.16","@seafile/seafile-sdoc-editor@3.0.15","@seafile/sdoc-editor@3.0.15","@seafile/seafile-sdoc-editor@3.0.14","@seafile/sdoc-editor@3.0.14","@seafile/seafile-sdoc-editor@3.0.13","@seafile/sdoc-editor@3.0.13","@seafile/seafile-sdoc-editor@3.0.12","@seafile/sdoc-editor@3.0.12","@seafile/seafile-sdoc-editor@3.0.11","@seafile/sdoc-editor@3.0.11","@seafile/seafile-sdoc-editor@3.0.10","@seafile/sdoc-editor@3.0.10","@seafile/seafile-sdoc-editor@3.0.9","@seafile/sdoc-editor@3.0.9","@seafile/seafile-sdoc-editor@3.0.8","@seafile/sdoc-editor@3.0.8","@seafile/seafile-sdoc-editor@3.0.7","@seafile/sdoc-editor@3.0.7","@seafile/seafile-sdoc-editor@3.0.6","@seafile/sdoc-editor@3.0.6","@seafile/seafile-sdoc-editor@3.0.5","@seafile/sdoc-editor@3.0.5","@seafile/seafile-sdoc-editor@3.0.4","@seafile/sdoc-editor@3.0.4","@seafile/seafile-sdoc-editor@3.0.3","@seafile/sdoc-editor@3.0.3","@seafile/seafile-sdoc-editor@3.0.2","@seafile/sdoc-editor@3.0.2","@seafile/seafile-sdoc-editor@3.0.1","@seafile/sdoc-editor@3.0.1","@seafile/seafile-sdoc-editor@3.0.0","@seafile/sdoc-editor@3.0.0","@seafile/seafile-sdoc-editor@2.0.117","@seafile/sdoc-editor@2.0.200","@seafile/seafile-sdoc-editor@2.0.118","@seafile/sdoc-editor@2.0.201","@seafile/seafile-sdoc-editor@2.0.116","@seafile/sdoc-editor@2.0.199","@seafile/seafile-sdoc-editor@2.0.115","@seafile/sdoc-editor@2.0.198","@seafile/seafile-sdoc-editor@2.0.114","@seafile/sdoc-editor@2.0.197","@seafile/seafile-sdoc-editor@2.0.113","@seafile/sdoc-editor@2.0.196","@seafile/seafile-sdoc-editor@2.0.112","@seafile/sdoc-editor@2.0.195","@seafile/seafile-sdoc-editor@2.0.111","@seafile/sdoc-editor@2.0.194","@seafile/seafile-sdoc-editor@2.0.110","@seafile/sdoc-editor@2.0.193","@seafile/seafile-sdoc-editor@2.0.109","@seafile/sdoc-editor@2.0.192","@seafile/seafile-sdoc-editor@2.0.108","@seafile/sdoc-editor@2.0.191","@seafile/seafile-sdoc-editor@2.0.107","@seafile/sdoc-editor@2.0.190","@seafile/seafile-sdoc-editor@2.0.105","@seafile/sdoc-editor@2.0.188","@seafile/seafile-sdoc-editor@2.0.106","@seafile/sdoc-editor@2.0.189","@seafile/seafile-sdoc-editor@2.0.104","@seafile/sdoc-editor@2.0.187","@seafile/seafile-sdoc-editor@2.0.103","@seafile/sdoc-editor@2.0.186","@seafile/seafile-sdoc-editor@2.0.102","@seafile/sdoc-editor@2.0.185","@seafile/seafile-sdoc-editor@2.0.100","@seafile/sdoc-editor@2.0.183","@seafile/seafile-sdoc-editor@2.0.101","@seafile/sdoc-editor@2.0.184","@seafile/seafile-sdoc-editor@2.0.99","@seafile/sdoc-editor@2.0.182","@seafile/seafile-sdoc-editor@2.0.98","@seafile/sdoc-editor@2.0.181","@seafile/seafile-sdoc-editor@2.0.97","@seafile/sdoc-editor@2.0.180","@seafile/seafile-sdoc-editor@2.0.93","@seafile/sdoc-editor@2.0.176","@seafile/seafile-sdoc-editor@2.0.96","@seafile/sdoc-editor@2.0.179","@seafile/seafile-sdoc-editor@2.0.95","@seafile/sdoc-editor@2.0.178","@seafile/seafile-sdoc-editor@2.0.94","@seafile/sdoc-editor@2.0.177","@seafile/seafile-sdoc-editor@2.0.92","@seafile/sdoc-editor@2.0.175","@seafile/seafile-sdoc-editor@2.0.91","@seafile/sdoc-editor@2.0.174","@seafile/seafile-sdoc-editor@2.0.90","@seafile/sdoc-editor@2.0.173","@seafile/seafile-sdoc-editor@2.0.89","@seafile/sdoc-editor@2.0.172","@seafile/seafile-sdoc-editor@2.0.88","@seafile/sdoc-editor@2.0.171","@seafile/seafile-sdoc-editor@2.0.87","@seafile/sdoc-editor@2.0.170","@seafile/seafile-sdoc-editor@2.0.83","@seafile/sdoc-editor@2.0.166","@seafile/seafile-sdoc-editor@2.0.86","@seafile/sdoc-editor@2.0.169","@seafile/seafile-sdoc-editor@2.0.85","@seafile/sdoc-editor@2.0.168","@seafile/seafile-sdoc-editor@2.0.84","@seafile/sdoc-editor@2.0.167","@seafile/seafile-sdoc-editor@2.0.82","@seafile/sdoc-editor@2.0.165","@seafile/seafile-sdoc-editor@2.0.81","@seafile/sdoc-editor@2.0.164","@seafile/seafile-sdoc-editor@2.0.78","@seafile/sdoc-editor@2.0.161","@seafile/seafile-sdoc-editor@2.0.80","@seafile/sdoc-editor@2.0.163","@seafile/seafile-sdoc-editor@2.0.79","@seafile/sdoc-editor@2.0.162","@seafile/seafile-sdoc-editor@2.0.77","@seafile/sdoc-editor@2.0.160","@seafile/seafile-sdoc-editor@2.0.76","@seafile/sdoc-editor@2.0.159","@seafile/seafile-sdoc-editor@2.0.75","@seafile/sdoc-editor@2.0.158","@seafile/seafile-sdoc-editor@2.0.74","@seafile/sdoc-editor@2.0.157","@seafile/seafile-sdoc-editor@2.0.73","@seafile/sdoc-editor@2.0.156","@seafile/seafile-sdoc-editor@2.0.72","@seafile/sdoc-editor@2.0.155","@seafile/seafile-sdoc-editor@2.0.70","@seafile/sdoc-editor@2.0.153","@seafile/seafile-sdoc-editor@2.0.71","@seafile/sdoc-editor@2.0.154","@seafile/seafile-sdoc-editor@2.0.69","@seafile/sdoc-editor@2.0.152","@seafile/seafile-sdoc-editor@2.0.68","@seafile/sdoc-editor@2.0.151","@seafile/seafile-sdoc-editor@2.0.67","@seafile/sdoc-editor@2.0.150","@seafile/seafile-sdoc-editor@2.0.66","@seafile/sdoc-editor@2.0.149","@seafile/seafile-sdoc-editor@2.0.65","@seafile/sdoc-editor@2.0.148","@seafile/seafile-sdoc-editor@2.0.64","@seafile/sdoc-editor@2.0.147","@seafile/seafile-sdoc-editor@2.0.63","@seafile/sdoc-editor@2.0.146","@seafile/seafile-sdoc-editor@2.0.62","@seafile/sdoc-editor@2.0.145","@seafile/seafile-sdoc-editor@2.0.61","@seafile/sdoc-editor@2.0.144","@seafile/seafile-sdoc-editor@2.0.60","@seafile/sdoc-editor@2.0.143","@seafile/seafile-sdoc-editor@2.0.59","@seafile/sdoc-editor@2.0.142","@seafile/seafile-sdoc-editor@2.0.58","@seafile/sdoc-editor@2.0.141","@seafile/seafile-sdoc-editor@2.0.57","@seafile/sdoc-editor@2.0.140","@seafile/seafile-sdoc-editor@2.0.53","@seafile/sdoc-editor@2.0.136","@seafile/seafile-sdoc-editor@2.0.56","@seafile/sdoc-editor@2.0.139","@seafile/seafile-sdoc-editor@2.0.55","@seafile/sdoc-editor@2.0.138","@seafile/seafile-sdoc-editor@2.0.54","@seafile/sdoc-editor@2.0.137","@seafile/seafile-sdoc-editor@2.0.52","@seafile/sdoc-editor@2.0.135","@seafile/seafile-sdoc-editor@2.0.51","@seafile/sdoc-editor@2.0.134","@seafile/seafile-sdoc-editor@2.0.50","@seafile/sdoc-editor@2.0.133","@seafile/seafile-sdoc-editor@2.0.49","@seafile/sdoc-editor@2.0.132","@seafile/seafile-sdoc-editor@2.0.48","@seafile/sdoc-editor@2.0.131","@seafile/seafile-sdoc-editor@2.0.47","@seafile/sdoc-editor@2.0.130","@seafile/seafile-sdoc-editor@2.0.46","@seafile/sdoc-editor@2.0.129","@seafile/seafile-sdoc-editor@2.0.45","@seafile/sdoc-editor@2.0.128","@seafile/seafile-sdoc-editor@2.0.44","@seafile/sdoc-editor@2.0.127","@seafile/seafile-sdoc-editor@2.0.43","@seafile/sdoc-editor@2.0.126","@seafile/seafile-sdoc-editor@2.0.41","@seafile/sdoc-editor@2.0.124","@seafile/seafile-sdoc-editor@2.0.42","@seafile/sdoc-editor@2.0.125","@seafile/seafile-sdoc-editor@2.0.31","@seafile/sdoc-editor@2.0.114","@seafile/seafile-sdoc-editor@2.0.40","@seafile/sdoc-editor@2.0.123","@seafile/seafile-sdoc-editor@2.0.39","@seafile/sdoc-editor@2.0.122","@seafile/seafile-sdoc-editor@2.0.38","@seafile/sdoc-editor@2.0.121","@seafile/seafile-sdoc-editor@2.0.37","@seafile/sdoc-editor@2.0.120","@seafile/seafile-sdoc-editor@2.0.36","@seafile/sdoc-editor@2.0.119","@seafile/seafile-sdoc-editor@2.0.35","@seafile/sdoc-editor@2.0.118","@seafile/seafile-sdoc-editor@2.0.34","@seafile/sdoc-editor@2.0.117","@seafile/seafile-sdoc-editor@2.0.33","@seafile/sdoc-editor@2.0.116","@seafile/seafile-sdoc-editor@2.0.32","@seafile/sdoc-editor@2.0.115","@seafile/seafile-sdoc-editor@2.0.30","@seafile/sdoc-editor@2.0.113","@seafile/seafile-sdoc-editor@2.0.29","@seafile/sdoc-editor@2.0.112","@seafile/seafile-sdoc-editor@2.0.28","@seafile/sdoc-editor@2.0.111","@seafile/seafile-sdoc-editor@2.0.27","@seafile/sdoc-editor@2.0.110","@seafile/seafile-sdoc-editor@2.0.26","@seafile/sdoc-editor@2.0.109","@seafile/seafile-sdoc-editor@2.0.25","@seafile/sdoc-editor@2.0.108","@seafile/seafile-sdoc-editor@2.0.24","@seafile/sdoc-editor@2.0.107","@seafile/seafile-sdoc-editor@2.0.21","@seafile/sdoc-editor@2.0.104","@seafile/seafile-sdoc-editor@2.0.23","@seafile/sdoc-editor@2.0.106","@seafile/seafile-sdoc-editor@2.0.22","@seafile/sdoc-editor@2.0.105","@seafile/seafile-sdoc-editor@2.0.20","@seafile/sdoc-editor@2.0.103","@seafile/seafile-sdoc-editor@2.0.17","@seafile/sdoc-editor@2.0.100","@seafile/seafile-sdoc-editor@2.0.19","@seafile/sdoc-editor@2.0.102","@seafile/seafile-sdoc-editor@2.0.18","@seafile/sdoc-editor@2.0.101","@seafile/seafile-sdoc-editor@2.0.15","@seafile/sdoc-editor@2.0.98","@seafile/seafile-sdoc-editor@2.0.16","@seafile/sdoc-editor@2.0.99","@seafile/seafile-sdoc-editor@2.0.14","@seafile/sdoc-editor@2.0.97","@seafile/seafile-sdoc-editor@2.0.13","@seafile/sdoc-editor@2.0.96","@seafile/seafile-sdoc-editor@2.0.11","@seafile/sdoc-editor@2.0.94","@seafile/seafile-sdoc-editor@2.0.12","@seafile/sdoc-editor@2.0.95","@seafile/seafile-sdoc-editor@2.0.9","@seafile/sdoc-editor@2.0.92","@seafile/seafile-sdoc-editor@2.0.10","@seafile/sdoc-editor@2.0.93","@seafile/seafile-sdoc-editor@2.0.7","@seafile/sdoc-editor@2.0.90","@seafile/seafile-sdoc-editor@2.0.6","@seafile/sdoc-editor@2.0.89","@seafile/seafile-sdoc-editor@2.0.5","@seafile/sdoc-editor@2.0.88","@seafile/seafile-sdoc-editor@2.0.4","@seafile/sdoc-editor@2.0.87","@seafile/seafile-sdoc-editor@2.0.3","@seafile/sdoc-editor@2.0.86","@seafile/seafile-sdoc-editor@2.0.2","@seafile/sdoc-editor@2.0.85","@seafile/seafile-sdoc-editor@2.0.1","@seafile/sdoc-editor@2.0.84"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-30587.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/haiwen/seahub","events":[{"introduced":"0"},{"fixed":"1ed0696df21f62fb5674d0dddd4d3f6239a088f7"},{"introduced":"b5f4bd0ffa2ee61b4bb38709bfe2350bfe542ac1"},{"fixed":"4c5301747bdb84c64b2f2b3230417df2d1cc8987"}],"database_specific":{"source":["CPE_RANGE","CPE_STRING","REFERENCES"],"cpe":["cpe:2.3:a:seafile:seafile_server:*:*:*:*:professional:*:*:*","cpe:2.3:a:seafile:seafile_server:13.0.15:*:*:*:community:*:*:*","cpe:2.3:a:seafile:seafile_server:13.0.16:*:*:*:professional:*:*:*"],"extracted_events":[{"introduced":"0"},{"fixed":"12.0.20"},{"introduced":"13.0.15"},{"last_affected":"13.0.15"},{"introduced":"13.0.16"},{"last_affected":"13.0.16"}]}}],"versions":["13.0.15","13.0.16","v4.2.2-server","v4.2.0-pro","v4.2.1-server","v4.2.0-server","v4.1.2-server","v4.1.0-pro","v4.1.1-server","v4.1.0-server","v4.0.0-pro","v4.0.1-server","v4.0.0-server","v3.1.7-server","v3.1.2-server-testing","v3.1.1-server","v3.1.1-server-testing","v3.1.0-server-testing","v2.1.3-testing","v2.1.3-server-testing","v2.1.3-server","v2.1.0-server-testing","v2.0.2-server","v2.0.1-pro","v1.7.0.2","v1.7.0","v1.6.0","v1.6.0-preview","v1.5.1","v1.5.0","v1.5.1-server","v1.4.0","1.2.0","0.9.3","0.9.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-30587.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}]}