CVE-2025-65516: XSS
A stored cross-site scripting (XSS) vulnerability was discovered in Seafile Community Edition prior to version 13.0.12. When Seafile is configured with the Golang file server, an attacker can upload a crafted SVG file containing malicious JavaScript and share it using a public link. Opening the link triggers script execution in the victim's browser. This issue has been fixed in Seafile Community Edition 13.0.12.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Seafile Community Editionto a version that resolves this vulnerability.Fixed in 13.0.12
Event History
Frequently Asked Questions
What is the severity of CVE-2025-65516?
CVE-2025-65516 is classified as a stored cross-site scripting (XSS) vulnerability.
How do I fix CVE-2025-65516?
To fix CVE-2025-65516, upgrade Seafile Community Edition to version 13.0.12 or later.
What software is affected by CVE-2025-65516?
CVE-2025-65516 affects Seafile Community Edition versions prior to 13.0.12 when configured with the Golang file server.
What type of attack is possible with CVE-2025-65516?
CVE-2025-65516 allows an attacker to perform a stored cross-site scripting attack by uploading a malicious SVG file.
How can an attacker exploit CVE-2025-65516?
An attacker can exploit CVE-2025-65516 by uploading a crafted SVG file to Seafile and sharing it via a public link.