CVE-2026-125362 · Package
NO FIX YET
Seahub, the file-sharing web app behind Seafile, generates batch share link passwords with Python's non-cryptographic random.choices(). An authenticated user who collects enough generated passwords can recover the generator state and predict other users' share link passwords.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that run self-hosted Seahub or Seafile where users can create share links. Exposure requires an authenticated account allowed to create share links and use the batch endpoint. Sources do not state a fixed version, and the linked patch page was not read.
Not affected if auth-required, managed-hosting, no-share-links
Who cares python, seafile, seahub, self-hosted
No fix yet, per the sources.
Seahub through 14.0.10 contains a weak randomness vulnerability in MultiShareLinksBatch.post() that generates batch share link passwords using Python's non-cryptographic random.choices(). Authenticated users permitted to create share links can request many generated passwords via the multi-share-links batch endpoint, recover the Mersenne Twister state, and predict other users' share link passwords.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.