CVE-2026-30587

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-30587

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-30587.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-30587

Aliases

GHSA-rqj3-x344-qvxc

Published

2026-03-25T00:00:00Z

Modified

2026-07-15T01:49:03.100524832Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

[none]

Details

Multiple Stored XSS vulnerabilities exist in Seafile Server version 13.0.15,13.0.16-pro,12.0.14 and prior and fixed in 13.0.17, 13.0.17-pro, and 12.0.20-pro, via the Seadoc (sdoc) editor. The application fails to properly sanitize WebSocket messages regarding document structure updates. This allows authenticated remote attackers to inject malicious JavaScript payloads via the src attribute of embedded Excalidraw whiteboards or the href attribute of anchor tags

Database specific

{
    "cna_assigner": "mitre",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30587.json"
}

References

Affected packages

Git / github.com/haiwen/seadoc-editor

Affected ranges

Type

GIT

Repo

https://github.com/haiwen/seadoc-editor

Events

Introduced

Fixed

8fa988aaede072b2ae073d1b2edcb2fc691423b2

Database specific

{
    "source": "REFERENCES"
}

Affected versions

@seafile/sdoc-editor@2.*

@seafile/sdoc-editor@2.0.100

@seafile/sdoc-editor@2.0.101

@seafile/sdoc-editor@2.0.102

@seafile/sdoc-editor@2.0.103

@seafile/sdoc-editor@2.0.104

@seafile/sdoc-editor@2.0.105

@seafile/sdoc-editor@2.0.106

@seafile/sdoc-editor@2.0.107

@seafile/sdoc-editor@2.0.108

@seafile/sdoc-editor@2.0.109

@seafile/sdoc-editor@2.0.110

@seafile/sdoc-editor@2.0.111

@seafile/sdoc-editor@2.0.112

@seafile/sdoc-editor@2.0.113

@seafile/sdoc-editor@2.0.114

@seafile/sdoc-editor@2.0.115

@seafile/sdoc-editor@2.0.116

@seafile/sdoc-editor@2.0.117

@seafile/sdoc-editor@2.0.118

@seafile/sdoc-editor@2.0.119

@seafile/sdoc-editor@2.0.120

@seafile/sdoc-editor@2.0.121

@seafile/sdoc-editor@2.0.122

@seafile/sdoc-editor@2.0.123

@seafile/sdoc-editor@2.0.124

@seafile/sdoc-editor@2.0.125

@seafile/sdoc-editor@2.0.126

@seafile/sdoc-editor@2.0.127

@seafile/sdoc-editor@2.0.128

@seafile/sdoc-editor@2.0.129

@seafile/sdoc-editor@2.0.130

@seafile/sdoc-editor@2.0.131

@seafile/sdoc-editor@2.0.132

@seafile/sdoc-editor@2.0.133

@seafile/sdoc-editor@2.0.134

@seafile/sdoc-editor@2.0.135

@seafile/sdoc-editor@2.0.136

@seafile/sdoc-editor@2.0.137

@seafile/sdoc-editor@2.0.138

@seafile/sdoc-editor@2.0.139

@seafile/sdoc-editor@2.0.140

@seafile/sdoc-editor@2.0.141

@seafile/sdoc-editor@2.0.142

@seafile/sdoc-editor@2.0.143

@seafile/sdoc-editor@2.0.144

@seafile/sdoc-editor@2.0.145

@seafile/sdoc-editor@2.0.146

@seafile/sdoc-editor@2.0.147

@seafile/sdoc-editor@2.0.148

@seafile/sdoc-editor@2.0.149

@seafile/sdoc-editor@2.0.150

@seafile/sdoc-editor@2.0.151

@seafile/sdoc-editor@2.0.152

@seafile/sdoc-editor@2.0.153

@seafile/sdoc-editor@2.0.154

@seafile/sdoc-editor@2.0.155

@seafile/sdoc-editor@2.0.156

@seafile/sdoc-editor@2.0.157

@seafile/sdoc-editor@2.0.158

@seafile/sdoc-editor@2.0.159

@seafile/sdoc-editor@2.0.160

@seafile/sdoc-editor@2.0.161

@seafile/sdoc-editor@2.0.162

@seafile/sdoc-editor@2.0.163

@seafile/sdoc-editor@2.0.164

@seafile/sdoc-editor@2.0.165

@seafile/sdoc-editor@2.0.166

@seafile/sdoc-editor@2.0.167

@seafile/sdoc-editor@2.0.168

@seafile/sdoc-editor@2.0.169

@seafile/sdoc-editor@2.0.170

@seafile/sdoc-editor@2.0.171

@seafile/sdoc-editor@2.0.172

@seafile/sdoc-editor@2.0.173

@seafile/sdoc-editor@2.0.174

@seafile/sdoc-editor@2.0.175

@seafile/sdoc-editor@2.0.176

@seafile/sdoc-editor@2.0.177

@seafile/sdoc-editor@2.0.178

@seafile/sdoc-editor@2.0.179

@seafile/sdoc-editor@2.0.180

@seafile/sdoc-editor@2.0.181

@seafile/sdoc-editor@2.0.182

@seafile/sdoc-editor@2.0.183

@seafile/sdoc-editor@2.0.184

@seafile/sdoc-editor@2.0.185

@seafile/sdoc-editor@2.0.186

@seafile/sdoc-editor@2.0.187

@seafile/sdoc-editor@2.0.188

@seafile/sdoc-editor@2.0.189

@seafile/sdoc-editor@2.0.190

@seafile/sdoc-editor@2.0.191

@seafile/sdoc-editor@2.0.192

@seafile/sdoc-editor@2.0.193

@seafile/sdoc-editor@2.0.194

@seafile/sdoc-editor@2.0.195

@seafile/sdoc-editor@2.0.196

@seafile/sdoc-editor@2.0.197

@seafile/sdoc-editor@2.0.198

@seafile/sdoc-editor@2.0.199

@seafile/sdoc-editor@2.0.200

@seafile/sdoc-editor@2.0.201

@seafile/sdoc-editor@2.0.84

@seafile/sdoc-editor@2.0.85

@seafile/sdoc-editor@2.0.86

@seafile/sdoc-editor@2.0.87

@seafile/sdoc-editor@2.0.88

@seafile/sdoc-editor@2.0.89

@seafile/sdoc-editor@2.0.90

@seafile/sdoc-editor@2.0.92

@seafile/sdoc-editor@2.0.93

@seafile/sdoc-editor@2.0.94

@seafile/sdoc-editor@2.0.95

@seafile/sdoc-editor@2.0.96

@seafile/sdoc-editor@2.0.97

@seafile/sdoc-editor@2.0.98

@seafile/sdoc-editor@2.0.99

@seafile/sdoc-editor@3.*

@seafile/sdoc-editor@3.0.0

@seafile/sdoc-editor@3.0.1

@seafile/sdoc-editor@3.0.10

@seafile/sdoc-editor@3.0.11

@seafile/sdoc-editor@3.0.12

@seafile/sdoc-editor@3.0.13

@seafile/sdoc-editor@3.0.14

@seafile/sdoc-editor@3.0.15

@seafile/sdoc-editor@3.0.16

@seafile/sdoc-editor@3.0.17

@seafile/sdoc-editor@3.0.18

@seafile/sdoc-editor@3.0.19

@seafile/sdoc-editor@3.0.2

@seafile/sdoc-editor@3.0.20

@seafile/sdoc-editor@3.0.21

@seafile/sdoc-editor@3.0.22

@seafile/sdoc-editor@3.0.23

@seafile/sdoc-editor@3.0.24

@seafile/sdoc-editor@3.0.25

@seafile/sdoc-editor@3.0.26

@seafile/sdoc-editor@3.0.27

@seafile/sdoc-editor@3.0.28

@seafile/sdoc-editor@3.0.29

@seafile/sdoc-editor@3.0.3

@seafile/sdoc-editor@3.0.30

@seafile/sdoc-editor@3.0.31

@seafile/sdoc-editor@3.0.32

@seafile/sdoc-editor@3.0.33

@seafile/sdoc-editor@3.0.34

@seafile/sdoc-editor@3.0.35

@seafile/sdoc-editor@3.0.36

@seafile/sdoc-editor@3.0.37

@seafile/sdoc-editor@3.0.38

@seafile/sdoc-editor@3.0.39

@seafile/sdoc-editor@3.0.4

@seafile/sdoc-editor@3.0.40

@seafile/sdoc-editor@3.0.41

@seafile/sdoc-editor@3.0.42

@seafile/sdoc-editor@3.0.43

@seafile/sdoc-editor@3.0.44

@seafile/sdoc-editor@3.0.45

@seafile/sdoc-editor@3.0.46

@seafile/sdoc-editor@3.0.47

@seafile/sdoc-editor@3.0.48

@seafile/sdoc-editor@3.0.49

@seafile/sdoc-editor@3.0.5

@seafile/sdoc-editor@3.0.50

@seafile/sdoc-editor@3.0.51

@seafile/sdoc-editor@3.0.52

@seafile/sdoc-editor@3.0.53

@seafile/sdoc-editor@3.0.54

@seafile/sdoc-editor@3.0.55

@seafile/sdoc-editor@3.0.56

@seafile/sdoc-editor@3.0.57

@seafile/sdoc-editor@3.0.58

@seafile/sdoc-editor@3.0.59

@seafile/sdoc-editor@3.0.6

@seafile/sdoc-editor@3.0.60

@seafile/sdoc-editor@3.0.61

@seafile/sdoc-editor@3.0.62

@seafile/sdoc-editor@3.0.63

@seafile/sdoc-editor@3.0.64

@seafile/sdoc-editor@3.0.65

@seafile/sdoc-editor@3.0.66

@seafile/sdoc-editor@3.0.67

@seafile/sdoc-editor@3.0.68

@seafile/sdoc-editor@3.0.69

@seafile/sdoc-editor@3.0.7

@seafile/sdoc-editor@3.0.70

@seafile/sdoc-editor@3.0.71

@seafile/sdoc-editor@3.0.72

@seafile/sdoc-editor@3.0.73

@seafile/sdoc-editor@3.0.74

@seafile/sdoc-editor@3.0.8

@seafile/sdoc-editor@3.0.9

@seafile/seafile-sdoc-editor@2.*

@seafile/seafile-sdoc-editor@2.0.1

@seafile/seafile-sdoc-editor@2.0.10

@seafile/seafile-sdoc-editor@2.0.100

@seafile/seafile-sdoc-editor@2.0.101

@seafile/seafile-sdoc-editor@2.0.102

@seafile/seafile-sdoc-editor@2.0.103

@seafile/seafile-sdoc-editor@2.0.104

@seafile/seafile-sdoc-editor@2.0.105

@seafile/seafile-sdoc-editor@2.0.106

@seafile/seafile-sdoc-editor@2.0.107

@seafile/seafile-sdoc-editor@2.0.108

@seafile/seafile-sdoc-editor@2.0.109

@seafile/seafile-sdoc-editor@2.0.11

@seafile/seafile-sdoc-editor@2.0.110

@seafile/seafile-sdoc-editor@2.0.111

@seafile/seafile-sdoc-editor@2.0.112

@seafile/seafile-sdoc-editor@2.0.113

@seafile/seafile-sdoc-editor@2.0.114

@seafile/seafile-sdoc-editor@2.0.115

@seafile/seafile-sdoc-editor@2.0.116

@seafile/seafile-sdoc-editor@2.0.117

@seafile/seafile-sdoc-editor@2.0.118

@seafile/seafile-sdoc-editor@2.0.12

@seafile/seafile-sdoc-editor@2.0.13

@seafile/seafile-sdoc-editor@2.0.14

@seafile/seafile-sdoc-editor@2.0.15

@seafile/seafile-sdoc-editor@2.0.16

@seafile/seafile-sdoc-editor@2.0.17

@seafile/seafile-sdoc-editor@2.0.18

@seafile/seafile-sdoc-editor@2.0.19

@seafile/seafile-sdoc-editor@2.0.2

@seafile/seafile-sdoc-editor@2.0.20

@seafile/seafile-sdoc-editor@2.0.21

@seafile/seafile-sdoc-editor@2.0.22

@seafile/seafile-sdoc-editor@2.0.23

@seafile/seafile-sdoc-editor@2.0.24

@seafile/seafile-sdoc-editor@2.0.25

@seafile/seafile-sdoc-editor@2.0.26

@seafile/seafile-sdoc-editor@2.0.27

@seafile/seafile-sdoc-editor@2.0.28

@seafile/seafile-sdoc-editor@2.0.29

@seafile/seafile-sdoc-editor@2.0.3

@seafile/seafile-sdoc-editor@2.0.30

@seafile/seafile-sdoc-editor@2.0.31

@seafile/seafile-sdoc-editor@2.0.32

@seafile/seafile-sdoc-editor@2.0.33

@seafile/seafile-sdoc-editor@2.0.34

@seafile/seafile-sdoc-editor@2.0.35

@seafile/seafile-sdoc-editor@2.0.36

@seafile/seafile-sdoc-editor@2.0.37

@seafile/seafile-sdoc-editor@2.0.38

@seafile/seafile-sdoc-editor@2.0.39

@seafile/seafile-sdoc-editor@2.0.4

@seafile/seafile-sdoc-editor@2.0.40

@seafile/seafile-sdoc-editor@2.0.41

@seafile/seafile-sdoc-editor@2.0.42

@seafile/seafile-sdoc-editor@2.0.43

@seafile/seafile-sdoc-editor@2.0.44

@seafile/seafile-sdoc-editor@2.0.45

@seafile/seafile-sdoc-editor@2.0.46

@seafile/seafile-sdoc-editor@2.0.47

@seafile/seafile-sdoc-editor@2.0.48

@seafile/seafile-sdoc-editor@2.0.49

@seafile/seafile-sdoc-editor@2.0.5

@seafile/seafile-sdoc-editor@2.0.50

@seafile/seafile-sdoc-editor@2.0.51

@seafile/seafile-sdoc-editor@2.0.52

@seafile/seafile-sdoc-editor@2.0.53

@seafile/seafile-sdoc-editor@2.0.54

@seafile/seafile-sdoc-editor@2.0.55

@seafile/seafile-sdoc-editor@2.0.56

@seafile/seafile-sdoc-editor@2.0.57

@seafile/seafile-sdoc-editor@2.0.58

@seafile/seafile-sdoc-editor@2.0.59

@seafile/seafile-sdoc-editor@2.0.6

@seafile/seafile-sdoc-editor@2.0.60

@seafile/seafile-sdoc-editor@2.0.61

@seafile/seafile-sdoc-editor@2.0.62

@seafile/seafile-sdoc-editor@2.0.63

@seafile/seafile-sdoc-editor@2.0.64

@seafile/seafile-sdoc-editor@2.0.65

@seafile/seafile-sdoc-editor@2.0.66

@seafile/seafile-sdoc-editor@2.0.67

@seafile/seafile-sdoc-editor@2.0.68

@seafile/seafile-sdoc-editor@2.0.69

@seafile/seafile-sdoc-editor@2.0.7

@seafile/seafile-sdoc-editor@2.0.70

@seafile/seafile-sdoc-editor@2.0.71

@seafile/seafile-sdoc-editor@2.0.72

@seafile/seafile-sdoc-editor@2.0.73

@seafile/seafile-sdoc-editor@2.0.74

@seafile/seafile-sdoc-editor@2.0.75

@seafile/seafile-sdoc-editor@2.0.76

@seafile/seafile-sdoc-editor@2.0.77

@seafile/seafile-sdoc-editor@2.0.78

@seafile/seafile-sdoc-editor@2.0.79

@seafile/seafile-sdoc-editor@2.0.80

@seafile/seafile-sdoc-editor@2.0.81

@seafile/seafile-sdoc-editor@2.0.82

@seafile/seafile-sdoc-editor@2.0.83

@seafile/seafile-sdoc-editor@2.0.84

@seafile/seafile-sdoc-editor@2.0.85

@seafile/seafile-sdoc-editor@2.0.86

@seafile/seafile-sdoc-editor@2.0.87

@seafile/seafile-sdoc-editor@2.0.88

@seafile/seafile-sdoc-editor@2.0.89

@seafile/seafile-sdoc-editor@2.0.9

@seafile/seafile-sdoc-editor@2.0.90

@seafile/seafile-sdoc-editor@2.0.91

@seafile/seafile-sdoc-editor@2.0.92

@seafile/seafile-sdoc-editor@2.0.93

@seafile/seafile-sdoc-editor@2.0.94

@seafile/seafile-sdoc-editor@2.0.95

@seafile/seafile-sdoc-editor@2.0.96

@seafile/seafile-sdoc-editor@2.0.97

@seafile/seafile-sdoc-editor@2.0.98

@seafile/seafile-sdoc-editor@2.0.99

@seafile/seafile-sdoc-editor@3.*

@seafile/seafile-sdoc-editor@3.0.0

@seafile/seafile-sdoc-editor@3.0.1

@seafile/seafile-sdoc-editor@3.0.10

@seafile/seafile-sdoc-editor@3.0.11

@seafile/seafile-sdoc-editor@3.0.12

@seafile/seafile-sdoc-editor@3.0.13

@seafile/seafile-sdoc-editor@3.0.14

@seafile/seafile-sdoc-editor@3.0.15

@seafile/seafile-sdoc-editor@3.0.16

@seafile/seafile-sdoc-editor@3.0.17

@seafile/seafile-sdoc-editor@3.0.18

@seafile/seafile-sdoc-editor@3.0.19

@seafile/seafile-sdoc-editor@3.0.2

@seafile/seafile-sdoc-editor@3.0.20

@seafile/seafile-sdoc-editor@3.0.21

@seafile/seafile-sdoc-editor@3.0.22

@seafile/seafile-sdoc-editor@3.0.23

@seafile/seafile-sdoc-editor@3.0.24

@seafile/seafile-sdoc-editor@3.0.25

@seafile/seafile-sdoc-editor@3.0.26

@seafile/seafile-sdoc-editor@3.0.27

@seafile/seafile-sdoc-editor@3.0.28

@seafile/seafile-sdoc-editor@3.0.29

@seafile/seafile-sdoc-editor@3.0.3

@seafile/seafile-sdoc-editor@3.0.30

@seafile/seafile-sdoc-editor@3.0.31

@seafile/seafile-sdoc-editor@3.0.32

@seafile/seafile-sdoc-editor@3.0.33

@seafile/seafile-sdoc-editor@3.0.34

@seafile/seafile-sdoc-editor@3.0.35

@seafile/seafile-sdoc-editor@3.0.36

@seafile/seafile-sdoc-editor@3.0.37

@seafile/seafile-sdoc-editor@3.0.38

@seafile/seafile-sdoc-editor@3.0.39

@seafile/seafile-sdoc-editor@3.0.4

@seafile/seafile-sdoc-editor@3.0.40

@seafile/seafile-sdoc-editor@3.0.41

@seafile/seafile-sdoc-editor@3.0.42

@seafile/seafile-sdoc-editor@3.0.43

@seafile/seafile-sdoc-editor@3.0.44

@seafile/seafile-sdoc-editor@3.0.45

@seafile/seafile-sdoc-editor@3.0.46

@seafile/seafile-sdoc-editor@3.0.47

@seafile/seafile-sdoc-editor@3.0.48

@seafile/seafile-sdoc-editor@3.0.49

@seafile/seafile-sdoc-editor@3.0.5

@seafile/seafile-sdoc-editor@3.0.50

@seafile/seafile-sdoc-editor@3.0.51

@seafile/seafile-sdoc-editor@3.0.52

@seafile/seafile-sdoc-editor@3.0.53

@seafile/seafile-sdoc-editor@3.0.54

@seafile/seafile-sdoc-editor@3.0.55

@seafile/seafile-sdoc-editor@3.0.56

@seafile/seafile-sdoc-editor@3.0.57

@seafile/seafile-sdoc-editor@3.0.58

@seafile/seafile-sdoc-editor@3.0.59

@seafile/seafile-sdoc-editor@3.0.6

@seafile/seafile-sdoc-editor@3.0.60

@seafile/seafile-sdoc-editor@3.0.61

@seafile/seafile-sdoc-editor@3.0.62

@seafile/seafile-sdoc-editor@3.0.63

@seafile/seafile-sdoc-editor@3.0.64

@seafile/seafile-sdoc-editor@3.0.65

@seafile/seafile-sdoc-editor@3.0.66

@seafile/seafile-sdoc-editor@3.0.67

@seafile/seafile-sdoc-editor@3.0.68

@seafile/seafile-sdoc-editor@3.0.69

@seafile/seafile-sdoc-editor@3.0.7

@seafile/seafile-sdoc-editor@3.0.70

@seafile/seafile-sdoc-editor@3.0.71

@seafile/seafile-sdoc-editor@3.0.72

@seafile/seafile-sdoc-editor@3.0.73

@seafile/seafile-sdoc-editor@3.0.74

@seafile/seafile-sdoc-editor@3.0.8

@seafile/seafile-sdoc-editor@3.0.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-30587.json"

Git / github.com/haiwen/seahub

Affected ranges

Type

GIT

Repo

https://github.com/haiwen/seahub

Events

Introduced

Fixed

1ed0696df21f62fb5674d0dddd4d3f6239a088f7

Introduced

b5f4bd0ffa2ee61b4bb38709bfe2350bfe542ac1

Fixed

4c5301747bdb84c64b2f2b3230417df2d1cc8987

Database specific

{
    "source": [
        "CPE_RANGE",
        "CPE_STRING",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "12.0.20"
        },
        {
            "introduced": "13.0.15"
        },
        {
            "last_affected": "13.0.15"
        },
        {
            "introduced": "13.0.16"
        },
        {
            "last_affected": "13.0.16"
        }
    ],
    "cpe": [
        "cpe:2.3:a:seafile:seafile_server:*:*:*:*:professional:*:*:*",
        "cpe:2.3:a:seafile:seafile_server:13.0.15:*:*:*:community:*:*:*",
        "cpe:2.3:a:seafile:seafile_server:13.0.16:*:*:*:professional:*:*:*"
    ]
}

Affected versions

0.*

0.9.2

0.9.3

1.*

1.2.0

13.*

13.0.15

13.0.16

v1.*

v1.4.0

v1.5.0

v1.5.1

v1.5.1-server

v1.6.0

v1.6.0-preview

v1.7.0

v1.7.0.2

v2.*

v2.0.1-pro

v2.0.2-server

v2.1.0-server-testing

v2.1.3-server

v2.1.3-server-testing

v2.1.3-testing

v3.*

v3.1.0-server-testing

v3.1.1-server

v3.1.1-server-testing

v3.1.2-server-testing

v3.1.7-server

v4.*

v4.0.0-pro

v4.0.0-server

v4.0.1-server

v4.1.0-pro

v4.1.0-server

v4.1.1-server

v4.1.2-server

v4.2.0-pro

v4.2.0-server

v4.2.1-server

v4.2.2-server

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-30587.json"