Stored Cross-Site Scripting Vulnerability in Seafile by Seafile Ltd.

CVE-2025-41079

What is CVE-2025-41079?

A vulnerability exists in Seafile v12.0.10 that enables an attacker to carry out stored Cross-Site Scripting (XSS) attacks. By exploiting this flaw, an attacker can craft malicious payloads that are stored via the PUT parameter 'name' in the '/api/v2.1/user/' endpoint. When a victim interacts with the compromised application, the malicious payload is executed in their browser, potentially leading to unauthorized access or data theft.

References