CVE-2026-125362: falha de baixa gravidade em haiwen seahub
Seahub through 14.0.10 Predictable Share Link Passwords via Batch Endpoint
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
5Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 2.3
Seahub through 14.0.10 contains a weak randomness vulnerability in MultiShareLinksBatch.post() that generates batch share link passwords using Python's non-cryptographic random.choices(). Authenticated users permitted to create share links can request many generated passwords via the multi-share-links batch endpoint, recover the Mersenne Twister state, and predict other users' share link passwords.
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
haiwen · seahubCVEs relacionadas — haiwen seahub
No mesmo produto, das mais perigosas para as menos.
Referências
https://github.com/haiwen/seahubhttps://github.com/haiwen/seahub/blob/v14.0.10-pro/seahub/api2/endpoints/multi_share_links.py#L502-L512https://github.com/haiwen/seahub/commit/dd3ba0341031fd29cabe4855b548badde861df52https://github.com/haiwen/seahub/issues/9687https://www.vulncheck.com/advisories/seahub-through-14.0.10-predictable-share-link-passwords-via-batch-endpoint