CVE-2025-41080CWE-79cross-site-scripting
CVE-2025-41080
Medium · published December 4, 2025
What it is
A stored Cross-Site Scripting (XSS) vulnerability has been found in Seafile v12.0.10. This vulnerability allows an attacker to execute arbitrary code in the victim's browser by storing malicious payloads with POST parámetro 'p' in '/api/v2.1/repos/{repo_id}/file/'.
The record
Technical detail
- CVSS v3.1
- 6.1 · MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.00196 · 8.8th percentile
- Weakness
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Published
- 2025-12-04T17:16Z
Affected products (1)
| Product | Versions | Fixed in |
|---|
| seafile/seafile | < 12.0.14 | 12.0.14 |
References (1)
EPSS history
Timeline