CVE-2025-45091
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
Seafile versions 11.0.18-Pro, 12.0.10, and 12.0.10-Pro are vulnerable to a stored Cross-Site Scripting (XSS) attack. An authenticated attacker can exploit this vulnerability by modifying their username to include a malicious XSS payload in notifications and activities.
Risk Assessment
A malicious script could execute in other users' browsers, potentially leading to session theft, account takeover, or further attacks within the application. The organization may suffer reputational damage and data loss.
Recommendation
Update Seafile to a version that includes the fix (e.g., newer than the listed versions) or apply available workarounds. Also implement input validation and sanitization mechanisms and monitor for unusual username changes.
Other vulnerabilities in Seafile
See all- CVE-2025-41080Medium
A stored Cross-Site Scripting (XSS) vulnerability has been found in Seafile v12.0.10. An attacker can store malicious payloads via the POST parameter 'p' in '/api/v2.1/repos/{repo_id}/file/', allowing arbitrary code execution in the victim's browser.
- CVE-2025-41079Medium
A stored Cross-Site Scripting (XSS) vulnerability has been found in Seafile v12.0.10. An attacker can store malicious payloads via the PUT parameter 'name' in '/api/v2.1/user/', allowing arbitrary code execution in the victim's browser.
Original NVD description (English source)
Seafile versions 11.0.18-Pro, 12.0.10, and 12.0.10-Pro are vulnerable to a stored Cross-Site Scripting (XSS) attack. An authenticated attacker can exploit this vulnerability by modifying their username to include a malicious XSS payload in notification and activities.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS