The vulnerability is a stored cross‑site scripting flaw in the Seafile Server’s Seadoc editor. Malicious JavaScript can be injected into WebSocket messages that update document structure. Authenticated attackers can place scripts in either the src attribute of embedded Excalidraw whiteboards or the href attribute of anchor tags. Once the document is loaded by a victim, the script runs in that user’s browser context, potentially stealing credentials, compromising sessions, or performing other client‑side attacks.

Affected are Seafile Server releases 12.0.14 through 12.0.19 and 13.0.15 through 13.0.16‑pro (including early 13.0.x releases). The issue was addressed in 12.0.20‑pro, 13.0.17, and 13.0.17‑pro. Only versions prior to those fixes are vulnerable. The product is the Seafile Server, the file‑sharing and collaboration platform used by organizations.

The CVSS score of 5.4 ranks the flaw as moderate, while the EPSS score of less than 1 % suggests a low likelihood of current exploitation. Because the attack requires a legitimate user account to access a vulnerable document, the risk is confined to authenticated users. The flaw is not listed in CISA’s KEV catalog, implying no known widespread active exploitation. Nevertheless, any authenticated user can create or edit a document that contains the malicious payload, making the vulnerability suitable for targeted phishing or user‑specific attacks.