---
id: "CVE-2026-125362"
page: "https://infrastack.ai/live/CVE-2026-125362"
kind: "vulnerability"
aliases: ["CVE-2026-125362"]
title: "Seahub: weak randomness lets attackers predict share link passwords"
severity: "low"
cvss: 3.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "python", "seafile", "seahub", "self-hosted"]
not_affected_if: ["auth-required", "managed-hosting", "no-share-links"]
published_at: "2026-11-10T00:17:07+00:00"
first_seen_at: "2026-11-10T00:28:42+00:00"
updated_at: "2026-11-10T00:30:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125362", "first_seen_at": "2026-11-10T00:28:42+00:00"}]
exploit_sources: []
---

# Seahub: weak randomness lets attackers predict share link passwords

Link for people: https://infrastack.ai/live/CVE-2026-125362 (this .md is for agents)

Seahub, the file-sharing web app behind Seafile, generates batch share link passwords with Python's non-cryptographic random.choices(). An authenticated user who collects enough generated passwords can recover the generator state and predict other users' share link passwords.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Seahub version against the range through 14.0.10 in the sources.
- Look for use of the multi-share-links batch endpoint in access logs if you run Seahub.

## Timeline

- 2026-11-10T00:28:42+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125362

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/seahub-through-14.0.10-predictable-share-link-passwords-via-batch-endpoint
- [fix] Patch: github.com https://github.com/haiwen/seahub/commit/dd3ba0341031fd29cabe4855b548badde861df52

## From the sources

Seahub through 14.0.10 contains a weak randomness vulnerability in MultiShareLinksBatch.post() that generates batch share link passwords using Python's non-cryptographic random.choices(). Authenticated users permitted to create share links can request many generated passwords via the multi-share-links batch endpoint, recover the Mersenne Twister state, and predict other users' share link passwords.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_