Stored Cross-Site Scripting in Seafile by Seafile Ltd
CVE-2025-41080

5.1MEDIUM

Key Information:

Vendor

Seafile

Status
Seafile
Vendor
CVE Published:
4 December 2025

What is CVE-2025-41080?

A stored Cross-Site Scripting (XSS) vulnerability has been identified in Seafile version 12.0.10. This flaw enables attackers to inject malicious scripts into posts, which can be executed in the victims' browsers when they access targeted files. Specifically, the vulnerability occurs when harmful payloads are stored through the POST parameter 'p' at the endpoint '/api/v2.1/repos/{repo_id}/file/'. This exploitable issue poses significant risks for data integrity and user security.

Affected Version(s)

Seafile 12.0.14

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multip...

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Arnau Sola LĂłpez and Arnau Yepes Huguet
.