CVE-2025-65516: Seafile Server Stored XSS Vulnerability

CVE-2025-65516 Overview

CVE-2025-65516 is a stored cross-site scripting (XSS) vulnerability in Seafile Community Edition prior to version 13.0.12. When Seafile is deployed with the Golang file server component, an authenticated user can upload a crafted Scalable Vector Graphics (SVG) file containing embedded JavaScript. The attacker then generates a public share link for the file. When a victim opens the link, the malicious script executes in the victim's browser under the Seafile origin.

The issue is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation and has been fixed in Seafile Community Edition 13.0.12.

Critical Impact
Attackers can execute arbitrary JavaScript in the victim browser context, enabling session token theft, account takeover, and phishing against Seafile users.

Affected Products

Seafile Community Edition versions prior to 13.0.12
Seafile deployments configured with the Golang file server
Instances allowing public share links for uploaded files

Discovery Timeline

2025-12-04 - CVE-2025-65516 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-65516

Vulnerability Analysis

The vulnerability exists in how Seafile's Golang file server serves uploaded SVG files. SVG is an XML-based image format that natively supports embedded <script> elements and JavaScript event handlers. When the Golang file server returns an SVG file with a content type that browsers render as image/svg+xml or text/html, any embedded script runs in the origin of the Seafile domain.

Because files can be shared through public links, the attacker does not need to control the victim's session. A single link is sufficient to deliver the payload. The scope change reflected in the CVSS vector indicates the script gains access to resources outside the vulnerable component, which is consistent with browser same-origin exposure.

Root Cause

The root cause is missing output sanitization and unsafe content type handling for user-supplied SVG uploads. The Golang file server does not strip active content from SVG files and does not force a non-renderable disposition such as Content-Disposition: attachment or a safe content type like image/svg+xml combined with Content-Security-Policy: sandbox. A restrictive Content Security Policy (CSP) is also absent for shared file responses.

Attack Vector

An attacker with upload rights performs the following steps:

Craft an SVG file containing a <script> tag or an inline event handler such as onload that executes arbitrary JavaScript.
Upload the SVG to a Seafile library on a server using the Golang file server backend.
Generate a public share link for the file.
Deliver the link to the victim through email, chat, or another channel.

When the victim opens the link, the browser renders the SVG inline and executes the embedded JavaScript. The script runs with access to cookies, tokens, and Document Object Model (DOM) content associated with the Seafile origin. A proof of concept is referenced in the GitHub Gist PoC.

Detection Methods for CVE-2025-65516

Indicators of Compromise

SVG files uploaded to Seafile libraries containing <script>, javascript:, onload=, or onerror= strings.
Public share links generated shortly after suspicious SVG uploads.
Outbound requests from user browsers to attacker-controlled domains initiated from the Seafile origin.
Unexpected session activity from Seafile accounts whose users recently opened shared links.

Detection Strategies

Scan Seafile storage backends for SVG files containing script tags or JavaScript event handler attributes.
Inspect web server access logs for requests to /f/ or /lib/ share paths returning Content-Type: image/svg+xml.
Correlate SVG uploads with subsequent share link creation events in Seafile audit logs.
Monitor browser telemetry for JavaScript execution originating from Seafile-hosted SVG responses.

Monitoring Recommendations

Alert on any SVG file upload to Seafile that exceeds a size threshold consistent with script payloads.
Baseline normal SVG usage per library and flag deviations, especially from newly created accounts.
Track share link generation rates and investigate spikes tied to specific uploaders.
Ingest Seafile logs into a centralized logging platform for cross-source correlation with authentication events.

How to Mitigate CVE-2025-65516

Immediate Actions Required

Upgrade Seafile Community Edition to version 13.0.12 or later on all servers.
Audit existing libraries for SVG files uploaded before the patch and quarantine suspicious samples.
Revoke public share links associated with SVG files pending review.
Rotate session tokens for users who may have opened malicious share links.

Patch Information

The vendor fixed this vulnerability in Seafile Community Edition 13.0.12. Refer to the Seafile Server Changelog for release notes and upgrade instructions. Administrators running the Golang file server should prioritize this upgrade because the vulnerability is specific to that deployment configuration.

Workarounds

Disable the Golang file server if upgrading immediately is not possible, and revert to the standard file server backend.
Restrict SVG uploads at the reverse proxy by rejecting requests with Content-Type: image/svg+xml for share endpoints.
Configure the reverse proxy to append Content-Disposition: attachment for SVG responses on public share paths.
Enforce a strict Content Security Policy (CSP) on Seafile share endpoints to block inline script execution.

bash

# Example nginx snippet forcing SVG downloads on Seafile share paths
location ~* ^/f/.*\.svg$ {
    add_header Content-Disposition "attachment";
    add_header Content-Security-Policy "default-src 'none'; sandbox";
    add_header X-Content-Type-Options "nosniff";
    proxy_pass http://seafile_upstream;
}