Seafile Server releases 13.0.15, 13.0.16‑pro, 12.0.14 and earlier contain stored cross‑site scripting weaknesses in the Seadoc editor. The application does not sanitize certain WebSocket messages that describe document structure updates, allowing an authenticated remote user to embed malicious JavaScript through the src attribute of an Excalidraw whiteboard or the href attribute of an anchor tag. When another user opens or edits the affected document, the injected script runs in the victim’s browser.

The vulnerability affects Seafile Server from the vendor Seafile, including all community and professional editions up to and including version 13.0.15, 13.0.16‑pro, and 12.0.14. The issue was fixed in releases 13.0.17, 13.0.17‑pro, and 12.0.20‑pro, as well as later builds.

The CVSS score is 5.4, indicating moderate severity, while the EPSS score is below 1%, suggesting a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires a legitimate user to inject the payload into a Seadoc document; the attacker then relies on other users opening that document to trigger the injected code. The impact is limited to client-side code execution, which could affect the user’s browser session.