CVE-2026-129167

Name of the Vulnerable Software and Affected Versions Seafile SeaDoc converter versions 2.0.4 through 2.0.10 Seafile SeaDoc converter versions 3.0.0 through 3.0.7

Description An absolute path traversal issue exists that allows unauthenticated attackers with a public share token to execute code. An attacker can provide an absolute filename to the '/api/v1/confluence-to-wiki/' endpoint to extract a ZIP file from a download url into the Python library path, subsequently triggering the module import through a file-convert request.

Recommendations Update Seafile SeaDoc converter to version 2.0.11. Update Seafile SeaDoc converter to version 3.0.8.