CVE-2026-125362
3.1 LOWpublic exploit availablePublished 2026-11-10 · Updated 2026-11-10
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
Seahub through 14.0.10 contains a weak randomness vulnerability in MultiShareLinksBatch.post() that generates batch share link passwords using Python's non-cryptographic random.choices(). Authenticated users permitted to create share links can request many generated passwords via the multi-share-links batch endpoint, recover the Mersenne Twister state, and predict other users' share link passwords.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-338
Public exploit & PoC references
All references
- https://github.com/haiwen/seahub
- https://github.com/haiwen/seahub/blob/v14.0.10-pro/seahub/api2/endpoints/multi_share_links.py#L502-L512
- https://github.com/haiwen/seahub/commit/dd3ba0341031fd29cabe4855b548badde861df52
- https://github.com/haiwen/seahub/issues/9687
- https://www.vulncheck.com/advisories/seahub-through-14.0.10-predictable-share-link-passwords-via-batch-endpoint
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- UNSCOREDCVE-2026-102813
- MEDIUMCVE-2026-104356PoC
- LOWCVE-2026-107283PoC
- HIGHCVE-2026-107612
- UNSCOREDCVE-2026-111259
- UNSCOREDCVE-2026-111260
- LOWCVE-2026-112041PoC
- UNSCOREDCVE-2026-112240
Related by shared AI tags and CWE weakness class. Browse the full archive.