Stored Cross-Site Scripting Vulnerability in Seafile Community Edition
CVE-2025-65516

6.1MEDIUM

Key Information:

Vendor

Seafile

Status
Seafile Community Edition
Vendor
CVE Published:
4 December 2025

What is CVE-2025-65516?

In Seafile Community Edition versions prior to 13.0.12, a stored cross-site scripting vulnerability allows attackers to upload a malicious SVG file containing JavaScript. When this file is shared via a public link and accessed by an unsuspecting user, it results in script execution within the user's browser, potentially compromising sensitive information and user privacy. This vulnerability has been patched in version 13.0.12, emphasizing the importance of keeping software up to date to protect against such threats.

References

https://manual.seafile.com/latest/changelog/server-change...
https://gist.github.com/x0root/e5597622fede55b320d29a248d...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.