CVE-2025-45091: XSS

Published Sep 15, 2025

Updated

Seafile versions 11.0.18-Pro, 12.0.10, and 12.0.10-Pro are vulnerable to a stored Cross-Site Scripting (XSS) attack. An authenticated attacker can exploit this vulnerability by modifying their username to include a malicious XSS payload in notification and activities.

Affected Software

1 affected component

Seafile Seafile

Event History

Sep 15, 2025

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·08:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-45091?

CVE-2025-45091 is classified as a high severity vulnerability due to its potential to allow stored Cross-Site Scripting (XSS) attacks.

How do I fix CVE-2025-45091?

To fix CVE-2025-45091, upgrade to Seafile version 12.0.11 or later which addresses this vulnerability.

Who is affected by CVE-2025-45091?

CVE-2025-45091 affects users of Seafile versions 11.0.18-Pro, 12.0.10, and 12.0.10-Pro.

What type of attack is associated with CVE-2025-45091?

CVE-2025-45091 is associated with a stored Cross-Site Scripting (XSS) attack.

What can attackers do with CVE-2025-45091?

Attackers can exploit CVE-2025-45091 by injecting a malicious XSS payload into notifications and activities using modified usernames.