CVE-2026-30587 describes multiple stored XSS vulnerabilities in Seafile Server prior to versions 13.0.17, 13.0.17-pro, and 12.0.20-pro. The issue stems from the Seadoc editor's failure to properly sanitize WebSocket messages that update document structure, allowing authenticated attackers to inject malicious JavaScript via the src attribute of embedded Excalidraw whiteboards or the href attribute of anchor tags. This vulnerability is categorized under CWE-79 and has a CVSS 3.1 score of 5.4, reflecting a medium risk with network attack vector, low attack complexity, required privileges, and user interaction.

Successful exploitation allows authenticated remote attackers to execute stored cross-site scripting attacks, potentially leading to the execution of arbitrary JavaScript in the context of the victim's browser session. This can result in information disclosure and integrity impacts but does not affect availability. The vulnerability requires authentication and user interaction, limiting its scope somewhat. There are no known exploits in the wild as of the published date.

The vulnerabilities have been fixed in Seafile Server versions 13.0.17, 13.0.17-pro, and 12.0.20-pro. Users should upgrade to these or later versions to remediate the issue. Since this is not a cloud service, remediation depends on applying these official patches. Patch status is confirmed by the vendor advisory indicating fixed versions. No additional mitigation steps are specified.