Seafile vulnerabilities
3 known CVE vulnerabilities in Seafile, translated and rated.
- CVE-2025-41080Medium
A stored Cross-Site Scripting (XSS) vulnerability has been found in Seafile v12.0.10. An attacker can store malicious payloads via the POST parameter 'p' in '/api/v2.1/repos/{repo_id}/file/', allowing arbitrary code execution in the victim's browser.
- CVE-2025-41079Medium
A stored Cross-Site Scripting (XSS) vulnerability has been found in Seafile v12.0.10. An attacker can store malicious payloads via the PUT parameter 'name' in '/api/v2.1/user/', allowing arbitrary code execution in the victim's browser.
- CVE-2025-45091Medium
Seafile versions 11.0.18-Pro, 12.0.10, and 12.0.10-Pro are vulnerable to a stored Cross-Site Scripting (XSS) attack. An authenticated attacker can exploit this vulnerability by modifying their username to include a malicious XSS payload in notifications and activities.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS