CVE-2026-129167: SeaDoc converter 2.0.4 before 2.0.11 and 3.0.0 before 3.0.8 Path Traversal RCE via confluence-to-wiki
Seafile SeaDoc converter 2.0.4 before 2.0.11 and 3.0.0 before 3.0.8 contains an absolute path traversal vulnerability that allows unauthenticated attackers holding a public share token to execute code. Attackers supply an absolute filename to /api/v1/confluence-to-wiki/ to extract a ZIP from downloadurl into the Python library path, then trigger the module's import via a file-convert request.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Affected versions are SeaDoc converter 2.0.4 through versions before 2.0.11, and 3.0.0 through versions before 3.0.8. The vulnerable endpoint is /api/v1/confluence-to-wiki/.
What does an attacker need to exploit this issue?
An attacker does not need authentication, but must hold a public share token. They also need to provide an absolute filename and use the download_url flow to place a ZIP archive into the Python library path before triggering a file-convert request.
What is the impact of successful exploitation?
Successful exploitation allows code execution. The listed impact includes high confidentiality, integrity, and availability impact.