External risk intelligence

SeaDoc Converter Path Traversal Leading to Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-129167

The vulnerability exists in an API endpoint (/api/v1/confluence-to-wiki/) of a document conversion service. Such services are commonly exposed as internet-facing components in web applications to handle document processing and conversion tasks. The requirement for a public share token indicates this functionality is intended to be accessible to external users, making it a likely target for internet-based interaction.

Path Traversal

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in Seafile's SeaDoc converter that could allow unauthenticated attackers to execute code. The issue arises from how the system handles specific file conversions using a public share token. While the direct business impact is not detailed, it highlights a potential for unauthorized code execution within systems that utilize this conversion functionality.

Allows code execution via file conversion.
Critical vulnerability in document conversion tool.
Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker with a public share token can exploit this vulnerability by providing a crafted absolute filename to the `/api/v1/confluence-to-wiki/` endpoint. This allows them to extract a ZIP file into a sensitive Python library path. Subsequently, they can trigger code execution by initiating a file-conversion request that imports the compromised module.

Unauthenticated access to a public share.
Supplying an absolute filename to an API.
Potential for unauthenticated code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to execute code by supplying a specific filename to an API endpoint. This process involves extracting a ZIP archive from a provided download URL into a Python library path and then triggering its import, potentially leading to code execution under certain supported conditions.

System files and libraries at risk.
Path traversal to influence import paths.
Arbitrary code execution could occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

The SeaDoc converter's absolute path traversal vulnerability, exploitable with a public share token, likely falls under the purview of application owners or platform teams responsible for the Seafile deployment. The first practical step is to locate all instances of the affected SeaDoc converter, determine their network exposure and business criticality, and identify the accountable owner for each instance to initiate a prioritized remediation plan.

Application or platform teams should own remediation.
Verify exposed SeaDoc converter instances.
Plan updates during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Seafile SeaDoc converter?

SeaDoc converter is a component within the Seafile ecosystem designed to process and transform document formats. It provides API-based services, such as converting Confluence pages into wiki formats, allowing users to handle complex document migrations or integrations directly through the application's interface.

What does path traversal mean for CVE-2026-129167?

This vulnerability is classified as CWE-36: Absolute Path Traversal. It occurs when software fails to properly sanitize user input, allowing an attacker to navigate outside the intended directory. In this specific case, it lets an attacker place malicious files into sensitive Python library locations where the system normally keeps its core operational code.

How does an attacker trigger this vulnerability?

An attacker needs a public share token to access the affected API. They trigger the bug by sending a specific, absolute file path to the conversion endpoint. Simply visiting the site or interacting with standard functions does not trigger it; the process requires deliberately supplying a crafted URL that forces the system to download and extract a ZIP archive into the wrong directory.

Is my instance of SeaDoc converter at risk?

According to Halo Surface Signal, this component is often exposed to the internet to support document processing for external users. If your SeaDoc converter is internet-facing and facilitates public sharing, it is a likely target. You should prioritize checking any instance that is reachable outside your internal network boundaries.

How should I respond to this threat?

Start by auditing your infrastructure to identify all running versions of the SeaDoc converter. Once located, verify if they fall within the affected version ranges. Coordinate with your platform teams to plan and apply the necessary updates during your next scheduled maintenance window to replace the vulnerable code with a patched version.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.