Stored XSS Vulnerability in Seafile Product by Seafile
CVE-2025-45091

5.4MEDIUM

Key Information:

Vendor

Seafile

Status
Seafile
Vendor
CVE Published:
15 September 2025

What is CVE-2025-45091?

A stored Cross-Site Scripting vulnerability exists in Seafile versions 11.0.18-Pro, 12.0.10, and 12.0.10-Pro, allowing authenticated attackers to inject malicious scripts. This is achievable by altering their username to include harmful XSS payloads that can compromise user notifications and activity banners. Such exploits potentially execute scripts within the context of other users, leading to unauthorized actions or data exposure.

References

https://plus.seafile.com/wiki/publish/seafile-wiki/txzO/

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.