6.1
CVE-2025-65516
- EPSS 0.19%
- Veröffentlicht 04.12.2025 16:16:22
- Zuletzt bearbeitet 11.12.2025 18:16:47
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
LoginA stored cross-site scripting (XSS) vulnerability was discovered in Seafile Community Edition prior to version 13.0.12. When Seafile is configured with the Golang file server, an attacker can upload a crafted SVG file containing malicious JavaScript and share it using a public link. Opening the link triggers script execution in the victim's browser. This issue has been fixed in Seafile Community Edition 13.0.12.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Seafile ≫ Seafile Server SwEditioncommunity Version < 13.0.12
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.19% | 0.083 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | 6.1 | 2.8 | 2.7 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
|
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
https://gist.github.com/x0root/e5597622fede55b320d29a248dce01e6
https://manual.seafile.com/latest/changelog/server-changelog/