CVE Alert: CVE-2026-129167 – Seafile

Seafile SeaDoc converter 2.0.4 before 2.0.11 and 3.0.0 before 3.0.8 contains an absolute path traversal vulnerability that allows unauthenticated attackers holding a public token to execute code. Attackers supply an absolute filename to /api/v1/confluence-to-wiki/ to extract a ZIP from download_url into the Python library path, then trigger the module’s import via a file-convert request.

**Risk verdict:** This is a potentially severe route to code execution on the conversion service; urgency cannot be fully ranked because KEV, SSVC exploitation, PoC and EPSS data were not provided.

**Why this matters:** Successful exploitation could let an attacker run code with the converter’s service permissions, potentially exposing files or credentials and enabling tampering or service disruption. A public token is a meaningful prerequisite, but may be obtainable through shared content or disclosure; it should not be treated as strong authentication.

**Most likely attack path:** The endpoint is reachable over the network; exploitation requires a present prerequisite and has high attack complexity, but no account privileges or user interaction. The vulnerable service’s scope is unchanged, so direct impact is centred on that service, although accessible files, secrets or service integrations could provide further opportunities.

**Who is most exposed:** Self-hosted deployments with the conversion API internet-accessible, especially those supporting public sharing, are most exposed. Internal instances may also be at risk if untrusted users can obtain tokens.

Review API and proxy logs for unusual requests to the conversion endpoint, especially absolute paths or unexpected archive URLs.

Check converter working directories and Python library paths for recently created or modified files.

Investigate unexpected converter child processes, outbound connections or service-account activity.

Mitigation and prioritisation

Upgrade to a fixed release as soon as practical; verify the deployed converter build, not just the parent application.

Until patched, restrict endpoint access and disable conversion or public sharing where operationally feasible.

Rotate credentials accessible to the converter if compromise is suspected; preserve logs and inspect the host before restoring service.

Apply through change control, prioritising internet-facing instances; obtain KEV and EPSS status to refine urgency.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.