Executive Summary

CVE-2025-41079 is a stored Cross-Site Scripting (XSS) vulnerability in Seafile versions prior to 12.0.14. It allows an attacker to inject malicious code via the PUT parameter 'name' in the '/api/v2.1/user/' endpoint. This malicious code is stored and later executed in the victim's browser when the data is rendered, enabling the attacker to run arbitrary scripts. [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing attackers to execute arbitrary code in your browser when you interact with the affected Seafile instance. This can lead to theft of sensitive information, session hijacking, or other malicious actions performed on your behalf within the application. [1]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing the PUT parameter 'name' in the '/api/v2.1/user/' endpoint for stored Cross-Site Scripting (XSS) payloads. You can use tools like curl to send crafted PUT requests with malicious scripts in the 'name' parameter and then check if the payload is stored and executed when retrieved. For example, a command to test might be: curl -X PUT -H "Content-Type: application/json" -d '{"name":"<script>alert(1)</script>"}' https://your-seafile-server/api/v2.1/user/ followed by accessing the user data to see if the script executes. [1]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate step to mitigate this vulnerability is to upgrade Seafile to version 12.0.14 or later, where the issue has been fixed. Additionally, avoid using vulnerable versions and consider applying input validation or sanitization on the 'name' parameter if upgrading is not immediately possible. [1]

Useful 0 Not Useful 0