CVE-2025-41079 Overview
CVE-2025-41079 is a stored Cross-Site Scripting (XSS) vulnerability affecting Seafile v12.0.10, an open-source file synchronization and collaboration platform. The flaw resides in the /api/v2.1/user/ endpoint, where the name parameter accepted via HTTP PUT requests is not properly sanitized before being stored and rendered. An authenticated attacker can inject a malicious JavaScript payload that executes in the browser context of any user who later views the affected profile data. The weakness is categorized as [CWE-79] Improper Neutralization of Input During Web Page Generation.
Critical Impact
Authenticated attackers can persist JavaScript payloads in user profile data, enabling session token theft, account takeover, and unauthorized actions against Seafile users who render the malicious content.
Affected Products
- Seafile v12.0.10
- Seafile self-hosted deployments exposing the /api/v2.1/user/ endpoint
- Multi-tenant Seafile environments where users interact with attacker-controlled profile data
Discovery Timeline
- 2025-12-04 - CVE-2025-41079 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-41079
Vulnerability Analysis
The vulnerability is a stored XSS flaw in the Seafile web application's user profile API. When an authenticated user issues an HTTP PUT request to /api/v2.1/user/, the server accepts the name parameter without adequate output encoding or input validation. The supplied value is later reflected into HTML contexts rendered by other users, including administrators viewing the user directory or profile listings. Because the payload is persisted server-side, it triggers each time the vulnerable field is rendered, without further attacker interaction. Successful exploitation runs arbitrary JavaScript in the victim's browser session, bound to the Seafile origin. This gives attackers access to authenticated API calls, DOM content, and any client-side state exposed to the page. The stored nature of the flaw increases the blast radius across shared workspaces and administrative interfaces.
Root Cause
The root cause is missing contextual output encoding on the name field within Seafile's user profile handler. User-supplied data is trusted when written to the datastore and rendered directly into HTML without escaping angle brackets, quotes, or event handler syntax. Seafile does not enforce an allowlist on the character set for display names, allowing script tags and inline event handlers to survive the write-read cycle.
Attack Vector
Exploitation requires network access to the Seafile web interface, valid low-privileged credentials, and user interaction from a victim who loads the page rendering the payload. The attacker authenticates to Seafile, sends a PUT request to /api/v2.1/user/ with a crafted name value containing HTML or JavaScript, and waits for another user to view the affected content. Refer to the INCIBE Security Notice on Seafile Vulnerabilities for additional context.
Detection Methods for CVE-2025-41079
Indicators of Compromise
- PUT requests to /api/v2.1/user/ containing <script>, onerror=, onload=, or javascript: substrings in the name parameter.
- User profile records where the display name contains HTML tags, encoded angle brackets (%3Cscript%3E), or JavaScript event handler syntax.
- Unexpected outbound requests from browsers rendering Seafile pages to unfamiliar domains, indicating exfiltration by an injected payload.
Detection Strategies
- Inspect application and reverse-proxy logs for PUT requests to the user API endpoint carrying suspicious payload characters, and correlate with subsequent page views by other accounts.
- Query the Seafile user database periodically for display name fields that contain HTML metacharacters or exceed expected length and character set constraints.
- Deploy Content Security Policy (CSP) violation reporting to capture inline script execution attempts originating from stored profile fields.
Monitoring Recommendations
- Enable verbose HTTP request logging on the Seafile front-end and forward logs to a centralized analytics platform for anomaly analysis.
- Alert on administrator sessions loading pages that trigger CSP violations or unexpected JavaScript errors tied to profile rendering.
- Track account modification events across /api/v2.1/user/ and review high-frequency updates to the name field from a single source.
How to Mitigate CVE-2025-41079
Immediate Actions Required
- Identify all Seafile v12.0.10 instances and restrict administrative and profile-viewing pages to trusted networks until a fix is applied.
- Audit existing user records for name values containing HTML or JavaScript syntax and sanitize any offending entries.
- Rotate session tokens and reset credentials for accounts that may have viewed attacker-controlled profile data.
Patch Information
At the time of publication, Seafile had not published a vendor advisory listed in the NVD record. Administrators should monitor the INCIBE Security Notice on Seafile Vulnerabilities and the official Seafile release channels for a patched version above v12.0.10 addressing the name parameter handling.
Workarounds
- Deploy a Web Application Firewall (WAF) rule that blocks PUT requests to /api/v2.1/user/ whose body contains HTML tags or JavaScript event handler patterns.
- Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins, reducing the impact of stored payloads.
- Limit account creation and profile-editing permissions to vetted users, and require administrator approval for changes to display names.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
