CVE-2025-65516 — Seafile Stored XSS (SVG upload leads to arbitrary JavaScript execution in Golang file server)

Advisory.txt

CVE-2025-65516 — Seafile Stored XSS

[Suggested Description]:
A stored cross-site scripting (XSS) vulnerability exists in Seafile Community Edition when using the Golang file server. A crafted SVG file containing malicious JavaScript can be uploaded and accessed through a public sharing link, resulting in script execution in the victim’s browser.

[Vulnerability Type]: Cross Site Scripting (XSS)

[Affected Versions]:
Seafile Community Edition — all versions below 13.0.12

[Fixed Version]:
13.0.12

[Attack Type]: Remote

[Attack Vectors]:
An attacker uploads a malicious SVG file, shares the public link, and the payload executes when a victim opens the preview.

[Impact]: Stored XSS leading to arbitrary JavaScript execution and possible information exposure.

[Vendor Confirmed]: Yes

[Vendor Reference]:
https://manual.seafile.com/latest/changelog/server-changelog/

[Discoverer]:
Jose Alfredo Bukit

[Additional Information]:
Vendor credited the reporter and issued a bounty. Issue only affects deployments using the Golang file server.