CVE-2025-41080: Seafile Stored XSS Vulnerability

CVE-2025-41080 Overview

CVE-2025-41080 is a stored Cross-Site Scripting (XSS) vulnerability affecting Seafile v12.0.10. The flaw resides in the /api/v2.1/repos/{repo_id}/file/ API endpoint. An authenticated attacker can submit a malicious payload through the p POST parameter. The application stores this payload without proper sanitization or output encoding. When a victim accesses the affected resource, the payload executes in the victim's browser context. The issue is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Authenticated attackers can execute arbitrary JavaScript in a victim's browser, enabling session hijacking, credential theft, and unauthorized actions within the Seafile web interface.

Affected Products

Seafile v12.0.10
Seafile web interface exposing the /api/v2.1/repos/{repo_id}/file/ endpoint
Deployments where multiple users access shared repositories

Discovery Timeline

2025-12-04 - CVE-2025-41080 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-41080

Vulnerability Analysis

Seafile is an open-source file synchronization and collaboration platform. The vulnerable endpoint /api/v2.1/repos/{repo_id}/file/ accepts a p POST parameter that specifies file path or content metadata. The application fails to neutralize script content submitted through this parameter before storing it. When the stored data is later rendered in the web interface, the browser interprets the injected markup as executable script.

Stored XSS extends the attack window because the payload persists server-side. Any authenticated user who views the affected repository triggers execution. The impact scope crosses trust boundaries because one user's input reaches another user's browser. Attackers can chain the flaw with social engineering to target administrators and escalate access.

Root Cause

The root cause is missing input validation and output encoding on the p parameter within the file API handler. The application accepts user-controlled content and later reflects it into HTML responses without contextual escaping. Web application frameworks typically mitigate this class of flaw through templated auto-escaping, allow-list validation, and Content Security Policy enforcement.

Attack Vector

Exploitation requires network access to the Seafile web application and low-privilege authenticated access. The attacker sends a crafted POST request to /api/v2.1/repos/{repo_id}/file/ with the p parameter containing JavaScript payload. Victim interaction is required, since a legitimate user must navigate to the affected file or listing view for the stored payload to execute. Refer to the INCIBE CERT Notice on Seafile Vulnerabilities for additional technical context.

Detection Methods for CVE-2025-41080

Indicators of Compromise

POST requests to /api/v2.1/repos/{repo_id}/file/ containing HTML tags or script keywords such as <script>, onerror=, onload=, or javascript: in the p parameter
Unexpected outbound requests from user browsers to attacker-controlled domains shortly after opening Seafile file views
Anomalous session activity, such as concurrent sessions from disparate geolocations for the same account

Detection Strategies

Deploy web application firewall (WAF) rules that inspect POST bodies to Seafile API endpoints for script tags and event handlers
Enable and review Seafile access logs for POST requests containing URL-encoded HTML metacharacters in the p parameter
Correlate authenticated user activity against uploads or file operations that include HTML or JavaScript syntax

Monitoring Recommendations

Forward Seafile web and reverse proxy logs to a centralized SIEM for retention and pattern analysis
Alert on Content Security Policy violation reports if CSP is enforced in report-only or blocking mode
Monitor authenticated user accounts for behavioral anomalies following interaction with shared repositories

How to Mitigate CVE-2025-41080

Immediate Actions Required

Upgrade Seafile to a fixed version released after v12.0.10 as soon as vendor guidance is available
Restrict Seafile access to trusted networks using VPN or IP allow-listing while a patch is being applied
Audit existing repositories for stored content containing script tags or suspicious HTML in file paths and metadata
Rotate session tokens and force reauthentication for users who accessed potentially compromised repositories

Patch Information

Consult the INCIBE CERT Notice on Seafile Vulnerabilities and the Seafile project release notes for patched versions addressing CVE-2025-41080. Apply the upgrade in a staged rollout after validating compatibility with existing clients and integrations.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Configure a reverse proxy or WAF to block requests to /api/v2.1/repos/{repo_id}/file/ containing HTML metacharacters in the p parameter
Limit repository sharing to essential collaborators to reduce the population of potential victims
Educate users to avoid opening files from untrusted contributors until the vendor patch is applied

bash

# Example nginx rule blocking script-like payloads in the p parameter
location ~ ^/api/v2\.1/repos/[^/]+/file/ {
    if ($request_method = POST) {
        if ($request_body ~* "(<script|onerror=|onload=|javascript:)") {
            return 403;
        }
    }
    proxy_pass http://seafile_backend;
}