haiwen/seafile

haiwen/seafile

Releases294

Frequency2 weeks 3 days

Last Release26 days ago

Stars14.9K

Beyond file syncing and sharing, a new way to organize your files with extensible file properties and flexible views

Log in to subscribe

CVE History

CVE	Affected	Published	CVSS v3	CVSS v2
CVE-2025-41080NVD↗	< 12.0.14	Dec 4, 2025Thursday, 4 December 2025, 12:16	6.1 MEDIUM	—
A stored Cross-Site Scripting (XSS) vulnerability has been found in Seafile v12.0.10. This vulnerability allows an attacker to execute arbitrary code in the victim's browser by storing malicious payloads with POST parámetro 'p' in '/api/v2.1/repos/{repo_id}/file/'.
CVE-2025-41079NVD↗	< 12.0.14	Dec 4, 2025Thursday, 4 December 2025, 12:16	6.1 MEDIUM	—
A stored Cross-Site Scripting (XSS) vulnerability has been found in Seafile v12.0.10. This vulnerability allows an attacker to execute arbitrary code in the victim's browser by storing malicious payloads with PUT parámetro 'name' in '/api/v2.1/user/'.
CVE-2023-28873NVD↗	= 9.0.6	Dec 9, 2023Saturday, 9 December 2023, 07:15	5.4 MEDIUM	—
An XSS issue in wiki and discussion pages in Seafile 9.0.6 allows attackers to inject JavaScript into the Markdown editor.
CVE-2023-28874NVD↗	= 9.0.6	Dec 9, 2023Saturday, 9 December 2023, 07:15	6.1 MEDIUM	—
The next parameter in the /accounts/login endpoint of Seafile 9.0.6 allows attackers to redirect users to arbitrary sites.
CVE-2021-30146NVD↗	= 7.0.5	Apr 6, 2021Tuesday, 6 April 2021, 16:15	5.4 MEDIUM	3.5 LOW
Seafile 7.0.5 (2019) allows Persistent XSS via the "share of library functionality."
CVE-2013-7469NVD↗	<= 6.2.11	Feb 21, 2019Thursday, 21 February 2019, 03:29	—	5 MEDIUM
Seafile through 6.2.11 always uses the same Initialization Vector (IV) with Cipher Block Chaining (CBC) Mode to encrypt private data, making it easier to conduct chosen-plaintext attacks or dictionary attacks.