{"id":"CVE-2026-129167","kind":"vulnerability","aliases":["CVE-2026-129167"],"related":[],"title":"Seafile SeaDoc converter: path traversal lets attackers run code","description":"Seafile SeaDoc converter 2.0.4 before 2.0.11 and 3.0.0 before 3.0.8 contains an absolute path traversal vulnerability that allows unauthenticated attackers holding a public share token to execute code. Attackers supply an absolute filename to /api/v1/confluence-to-wiki/ to extract a ZIP from download_url into the Python library path, then trigger the module's import via a file-convert request.","summary":"The Seafile SeaDoc converter accepts an absolute filename in its confluence-to-wiki API, so a ZIP can be extracted into the Python library path. An attacker holding a public share token can then trigger an import of that module and execute code on the server.","severity":"critical","cvss":9.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Seafile SeaDoc converter","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["other","python","seafile","self-hosted"],"not_affected_if":["converter-not-running","no-public-shares"],"how_to_check":"- Check the installed SeaDoc converter version against the affected ranges (2.0.4 before 2.0.11, and 3.0.0 before 3.0.8).","fix":"- SeaDoc converter 2.0.x: move to `2.0.11` or later.\n- SeaDoc converter 3.0.x: move to `3.0.8` or later.","status":"open","published_at":"2026-11-13T18:17:41+00:00","first_seen_at":"2026-11-13T18:49:31+00:00","triaged_at":"2026-11-13T18:51:19+00:00","updated_at":"2026-11-13T18:51:19+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-13T18:51:19Z","model":"claude-haiku-5-5","output":{"fix":"- SeaDoc converter 2.0.x: move to `2.0.11` or later.\n- SeaDoc converter 3.0.x: move to `3.0.8` or later.","reach":"internet","title":"Seafile SeaDoc converter: path traversal lets attackers run code","impact":"high","summary":"The Seafile SeaDoc converter accepts an absolute filename in its confluence-to-wiki API, so a ZIP can be extracted into the Python library path. An attacker holding a public share token can then trigger an import of that module and execute code on the server.","audience":"businesses","category":"other","nicknames":[],"who_cares":["seafile","self-hosted","python"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker runs code on the server via a public share token","analyst_note":"Confirm the affected component and whether exposure requires a public share token; check the Patch link on github.com and the VulnCheck advisory for the exact fixed versions and any setting to disable the converter.","how_to_check":"- Check the installed SeaDoc converter version against the affected ranges (2.0.4 before 2.0.11, and 3.0.0 before 3.0.8).\n- unknown for other checks; the sources do not say.","plain_action":"","product_name":"Seafile SeaDoc converter","needs_analyst":true,"not_affected_if":["converter-not-running","no-public-shares"],"who_is_affected":"Teams that run Seafile with the SeaDoc converter service enabled and reachable from the network are exposed. The sources describe exploitation through a public share token, so instances without public sharing or without the converter running are less likely to be exposed. Teams not running SeaDoc can skip it.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000784,"input_tokens":4650,"output_tokens":638,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-129167':12A,15A '-2026':11A,14A '/api/v1/confluence-to-wiki':106C '2.0.11':77C '2.0.4':75C '3.0.0':79C '3.0.8':81C 'absolut':31B,84C,103C 'accept':29B 'allow':89C 'api':39B 'attack':7A,52B,91C,100C 'code':9A,68B,99C 'confluenc':36B 'confluence-to-wiki':35B 'contain':82C 'convert':3A,28B,74C,129C 'converter':18A 'cve':10A,13A 'download':112C 'execut':67B,98C 'extract':45B,108C 'file':128C 'file-convert':127C 'filenam':32B,104C 'hold':53B,92C 'host':24B 'import':62B,124C 'let':6A 'librari':49B,117C 'modul':65B,122C 'path':4A,50B,85C,118C 'public':55B,94C 'python':20B,48B,116C 'request':130C 'run':8A 'seadoc':2A,17A,27B,73C 'seafil':1A,21B,26B,72C 'seafile':16A 'self':23B 'self-host':22B 'server':71B 'share':56B,95C 'suppli':101C 'token':57B,96C 'travers':5A,86C 'trigger':60B,120C 'unauthent':90C 'url':113C 'via':125C 'vulner':87C 'wiki':38B 'zip':42B,110C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Seafile with the SeaDoc converter service enabled and reachable from the network are exposed. The sources describe exploitation through a public share token, so instances without public sharing or without the converter running are less likely to be exposed. Teams not running SeaDoc can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["seadocconverter","seafileseadocconverter"],"ptokens":["converter","seadoc","seafile"],"labels":["critical","other","python","seafile","selfhosted","vendor"],"campaign_type":null,"search_a":"'-129167':12A,15A '-2026':11A,14A 'attack':7A 'code':9A 'convert':3A 'converter':18A 'cve':10A,13A 'let':6A 'path':4A 'run':8A 'seadoc':2A,17A 'seafil':1A 'seafile':16A 'travers':5A","search_b":"'absolut':31B 'accept':29B 'api':39B 'attack':52B 'code':68B 'confluenc':36B 'confluence-to-wiki':35B 'convert':28B 'execut':67B 'extract':45B 'filenam':32B 'hold':53B 'host':24B 'import':62B 'librari':49B 'modul':65B 'path':50B 'public':55B 'python':20B,48B 'seadoc':27B 'seafil':21B,26B 'self':23B 'self-host':22B 'server':71B 'share':56B 'token':57B 'trigger':60B 'wiki':38B 'zip':42B","search_c":"'/api/v1/confluence-to-wiki':106C '2.0.11':77C '2.0.4':75C '3.0.0':79C '3.0.8':81C 'absolut':84C,103C 'allow':89C 'attack':91C,100C 'code':99C 'contain':82C 'convert':74C,129C 'download':112C 'execut':98C 'extract':108C 'file':128C 'file-convert':127C 'filenam':104C 'hold':92C 'import':124C 'librari':117C 'modul':122C 'path':85C,118C 'public':94C 'python':116C 'request':130C 'seadoc':73C 'seafil':72C 'share':95C 'suppli':101C 'token':96C 'travers':86C 'trigger':120C 'unauthent':90C 'url':113C 'via':125C 'vulner':87C 'zip':110C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T18:17:41+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129167","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129167","severity":null,"published_at":"2026-11-13T18:17:41+00:00","modified_at":"2026-11-13T18:17:41+00:00","first_seen_at":"2026-11-13T18:49:31+00:00","fetched_at":"2026-11-13T18:49:31+00:00","note":null}],"documents":[{"id":148624,"url":"https://github.com/haiwen/seadoc-converter/commit/cb43162e8bc2991a2900c8acf85090358a30e516","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":148625,"url":"https://www.vulncheck.com/advisories/seadoc-converter-2.0.4-before-2.0.11-and-3.0.0-before-3.0.8-path-traversal-rce-via-confluence-to-wiki","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}