CVE-2026-125362

Description

Seahub through 14.0.10 contains a weak randomness vulnerability in MultiShareLinksBatch.post() that generates batch share link passwords using Python's non-cryptographic random.choices(). Authenticated users permitted to create share links can request many generated passwords via the multi-share-links batch endpoint, recover the Mersenne Twister state, and predict other users' share link passwords.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://github.com/haiwen/seahub/issues/9687 ↗
• https://github.com/haiwen/seahub ↗
• https://github.com/haiwen/seahub/blob/v14.0.10-pro/seahub/api2/endpoints/multi_share_links.py#L502-L512 ↗
• https://github.com/haiwen/seahub/commit/dd3ba0341031fd29cabe4855b548badde861df52 ↗
• https://www.vulncheck.com/advisories/seahub-through-14.0.10-predictable-share-link-passwords-via-batch-endpoint ↗