SEAFILE SEADOC CONVERTER · CVE-2026-129167 · Other
NO FIX YET · SEE WHAT TO DO
The Seafile SeaDoc converter accepts an absolute filename in its confluence-to-wiki API, so a ZIP can be extracted into the Python library path. An attacker holding a public share token can then trigger an import of that module and execute code on the server.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that run Seafile with the SeaDoc converter service enabled and reachable from the network are exposed. The sources describe exploitation through a public share token, so instances without public sharing or without the converter running are less likely to be exposed. Teams not running SeaDoc can skip it.
Not affected if converter-not-running, no-public-shares
Who cares python, seafile, self-hosted
2.0.11 or later.3.0.8 or later.Seafile SeaDoc converter 2.0.4 before 2.0.11 and 3.0.0 before 3.0.8 contains an absolute path traversal vulnerability that allows unauthenticated attackers holding a public share token to execute code. Attackers supply an absolute filename to /api/v1/confluence-to-wiki/ to extract a ZIP from download_url into the Python library path, then trigger the module's import via a file-convert request.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.