Seafile

seafile

12 CVEs • 4 products

Products (4)

Click to collapse

Toggle

CVEs (12)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2026-30587 1Seafile 1Seafile Server May 10, 2026 Mar 25, 2026 N/A· v4 8.7 HIGH· v3 N/A· v2 Multiple Stored XSS vulnerabilities exist in Seafile Server version 13.0.15,13.0.16-pro,12.0.14 and prior and fixed in 13.0.17, 13.0.17-pro, and 12.0.20-pro, via the Seadoc (sdoc) editor. The application fails to properl...Show more Multiple Stored XSS vulnerabilities exist in Seafile Server version 13.0.15,13.0.16-pro,12.0.14 and prior and fixed in 13.0.17, 13.0.17-pro, and 12.0.20-pro, via the Seadoc (sdoc) editor. The application fails to properly sanitize WebSocket messages regarding document structure updates. This allows authenticated remote attackers to inject malicious JavaScript payloads via the src attribute of embedded Excalidraw whiteboards or the href attribute of anchor tagsShow less
CVE-2025-65516 1Seafile 1Seafile Server Dec 11, 2025 Dec 4, 2025 N/A· v4 6.1 MEDIUM· v3 N/A· v2 A stored cross-site scripting (XSS) vulnerability was discovered in Seafile Community Edition prior to version 13.0.12. When Seafile is configured with the Golang file server, an attacker can upload a crafted SVG file co...Show more A stored cross-site scripting (XSS) vulnerability was discovered in Seafile Community Edition prior to version 13.0.12. When Seafile is configured with the Golang file server, an attacker can upload a crafted SVG file containing malicious JavaScript and share it using a public link. Opening the link triggers script execution in the victim's browser. This issue has been fixed in Seafile Community Edition 13.0.12.Show less
CVE-2025-41080 1Seafile 1Seafile Dec 5, 2025 Dec 4, 2025 5.1 MEDIUM· v4 6.1 MEDIUM· v3 N/A· v2 A stored Cross-Site Scripting (XSS) vulnerability has been found in Seafile v12.0.10. This vulnerability allows an attacker to execute arbitrary code in the victim's browser by storing malicious payloads with POST paráme...Show more A stored Cross-Site Scripting (XSS) vulnerability has been found in Seafile v12.0.10. This vulnerability allows an attacker to execute arbitrary code in the victim's browser by storing malicious payloads with POST parámetro 'p' in '/api/v2.1/repos/{repo_id}/file/'.Show less
CVE-2025-41079 1Seafile 1Seafile Dec 5, 2025 Dec 4, 2025 5.1 MEDIUM· v4 6.1 MEDIUM· v3 N/A· v2 A stored Cross-Site Scripting (XSS) vulnerability has been found in Seafile v12.0.10. This vulnerability allows an attacker to execute arbitrary code in the victim's browser by storing malicious payloads with PUT parámet...Show more A stored Cross-Site Scripting (XSS) vulnerability has been found in Seafile v12.0.10. This vulnerability allows an attacker to execute arbitrary code in the victim's browser by storing malicious payloads with PUT parámetro 'name' in '/api/v2.1/user/'.Show less
CVE-2023-28874 1Seafile 1Seafile Nov 21, 2024 Dec 9, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 The next parameter in the /accounts/login endpoint of Seafile 9.0.6 allows attackers to redirect users to arbitrary sites.
CVE-2023-28873 1Seafile 1Seafile Nov 21, 2024 Dec 9, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 An XSS issue in wiki and discussion pages in Seafile 9.0.6 allows attackers to inject JavaScript into the Markdown editor.
CVE-2021-43820 1Seafile 1Seafile Server Nov 21, 2024 Dec 14, 2021 N/A· v4 5.9 MEDIUM· v3 4.3 MEDIUM· v2 Seafile is an open source cloud storage system. A sync token is used in Seafile file syncing protocol to authorize access to library data. To improve performance, the token is cached in memory in seaf-server. Upon receiv...Show more Seafile is an open source cloud storage system. A sync token is used in Seafile file syncing protocol to authorize access to library data. To improve performance, the token is cached in memory in seaf-server. Upon receiving a token from sync client or SeaDrive client, the server checks whether the token exist in the cache. However, if the token exists in cache, the server doesn't check whether it's associated with the specific library in the URL. This vulnerability makes it possible to use any valid sync token to access data from any known library. Note that the attacker has to first find out the ID of a library which it has no access to. The library ID is a random UUID, which is not possible to be guessed. There are no workarounds for this issue.Show less
CVE-2021-30146 1Seafile 1Seafile Nov 21, 2024 Apr 6, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Seafile 7.0.5 (2019) allows Persistent XSS via the "share of library functionality."
CVE-2020-16143 1Seafile 1Seafile Client Nov 21, 2024 Jul 29, 2020 N/A· v4 7.8 HIGH· v3 4.4 MEDIUM· v2 The seafile-client client 7.0.8 for Seafile is vulnerable to DLL hijacking because it loads exchndl.dll from the current working directory.
CVE-2013-7469 1Seafile 1Seafile Nov 21, 2024 Feb 21, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Seafile through 6.2.11 always uses the same Initialization Vector (IV) with Cipher Block Chaining (CBC) Mode to encrypt private data, making it easier to conduct chosen-plaintext attacks or dictionary attacks.
CVE-2019-8919 1Seafile 1Seadroid Nov 21, 2024 Feb 18, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The seadroid (aka Seafile Android Client) application through 2.2.13 for Android always uses the same Initialization Vector (IV) with Cipher Block Chaining (CBC) Mode to encrypt private data, making it easier to conduct...Show more The seadroid (aka Seafile Android Client) application through 2.2.13 for Android always uses the same Initialization Vector (IV) with Cipher Block Chaining (CBC) Mode to encrypt private data, making it easier to conduct chosen-plaintext attacks or dictionary attacks.Show less
CVE-2014-5443 1Seafile 1Seafile Server Nov 21, 2024 Mar 19, 2018 N/A· v4 7.8 HIGH· v3 4.6 MEDIUM· v2 Seafile Server before 3.1.2 and Server Professional Edition before 3.1.0 allow local users to gain privileges via vectors related to ccnet handling user accounts.