Skip to content
Path Traversal Vulnerability in Seafile SeaDoc Converter

Path Traversal Vulnerability in Seafile SeaDoc Converter

First seen 14 Nov 2026, 15:43 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 14, 2026 at 15:43 UTC
  • •CVE-2026-129167 affects Seafile SeaDoc converter versions 2.0.4 to 2.0.10 and 3.0.0 to 3.0.7.
  • •The vulnerability allows unauthenticated code execution via an API endpoint.
  • •Users should upgrade to fixed versions and restrict access to the vulnerable service.

Seafile SeaDoc converter versions 2.0.4 to 2.0.10 and 3.0.0 to 3.0.7 are affected by CVE-2026-129167, an absolute path traversal vulnerability. This flaw allows unauthenticated attackers with a public token to execute arbitrary code by supplying an absolute filename to a specific API endpoint. Successful exploitation could lead to unauthorized access to sensitive files and service disruption. The vulnerability has a CVSS score of 9.2, indicating its nature. Self-hosted deployments, particularly those with internet-accessible conversion APIs, are most at risk. Users are advised to upgrade to fixed versions as soon as possible and restrict access to the vulnerable endpoint until patched. The vulnerability was published on November 13, 2026, and is currently listed in the CISA KEV catalog.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-11-13
CVE-2026-129167 published
Seafile disclosed a critical absolute path traversal vulnerability affecting specific versions of the SeaDoc converter.
Sploitus
2026-11-14
CVE-2026-129167 reported by Redpacketsecurity
Redpacketsecurity provided detailed analysis and mitigation recommendations for the vulnerability.
Redpacketsecurity

More articles in this cluster (6)

Following this threat?

Track CVE-2026-129167 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (6)

1 / 4

Common questions

Which versions are affected?
Seafile SeaDoc converter versions 2.0.4 to 2.0.10 and 3.0.0 to 3.0.7 are affected.
What is the risk of exploitation?
The vulnerability allows unauthenticated attackers to execute arbitrary code, posing a significant risk to self-hosted deployments.
What should I do to mitigate this vulnerability?
Upgrade to the fixed versions as soon as possible and restrict access to the vulnerable API endpoint until patched.