CVE-2025-41079
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A stored Cross-Site Scripting (XSS) vulnerability has been found in Seafile v12.0.10. An attacker can store malicious payloads via the PUT parameter 'name' in '/api/v2.1/user/', allowing arbitrary code execution in the victim's browser.
Risk Assessment
An attacker can execute arbitrary JavaScript in the victim's browser, potentially leading to session or data theft. The risk affects Seafile instances running version 12.0.10.
Recommendation
Update Seafile to a version later than 12.0.10 if a fix is available. In the meantime, restrict API access and enforce input validation.
Other vulnerabilities in Seafile
See all- CVE-2025-41080Medium
A stored Cross-Site Scripting (XSS) vulnerability has been found in Seafile v12.0.10. An attacker can store malicious payloads via the POST parameter 'p' in '/api/v2.1/repos/{repo_id}/file/', allowing arbitrary code execution in the victim's browser.
- CVE-2025-45091Medium
Seafile versions 11.0.18-Pro, 12.0.10, and 12.0.10-Pro are vulnerable to a stored Cross-Site Scripting (XSS) attack. An authenticated attacker can exploit this vulnerability by modifying their username to include a malicious XSS payload in notifications and activities.
Original NVD description (English source)
A stored Cross-Site Scripting (XSS) vulnerability has been found in Seafile v12.0.10. This vulnerability allows an attacker to execute arbitrary code in the victim's browser by storing malicious payloads with PUT parámetro 'name' in '/api/v2.1/user/'.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS