{"id":"CVE-2025-41079","state":"PUBLISHED","title":"Multiple vulnerabilities in Seafile","description":"A stored Cross-Site Scripting (XSS) vulnerability has been found in Seafile v12.0.10. This vulnerability allows an attacker to execute arbitrary code in the victim's browser by storing malicious payloads with PUT parámetro 'name' in '/api/v2.1/user/'.","publishedAt":"2025-12-04T11:48:10.112Z","updatedAt":"2025-12-04T14:44:00.913Z","severity":{"score":5.1,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","source":"INCIBE"},"assigner":"INCIBE","products":["Seafile Seafile"],"affected":[{"vendor":"Seafile","product":"Seafile","defaultStatus":"unaffected","versions":[{"version":"12.0.14","status":"affected"}]}],"references":["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-seafile"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T20:09:09.358Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/41xxx/CVE-2025-41079.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-41079","state":"PUBLISHED","datePublished":"2025-12-04T11:48:10.112Z","dateUpdated":"2025-12-04T14:44:00.913Z","assignerShortName":"INCIBE","assignerOrgId":"0cbda920-cd7f-484a-8e76-bf7f4b7f4516","dateReserved":"2025-04-16T09:09:35.597Z"},"containers":{"cna":{"title":"Multiple vulnerabilities in Seafile","descriptions":[{"lang":"en","value":"A stored Cross-Site Scripting (XSS) vulnerability has been found in Seafile v12.0.10. This vulnerability allows an attacker to execute arbitrary code in the victim's browser by storing malicious payloads with PUT parámetro 'name' in '/api/v2.1/user/'."}],"affected":[{"vendor":"Seafile","product":"Seafile","defaultStatus":"unaffected","versions":[{"version":"12.0.14","status":"affected"}]}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-seafile"}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":5.1,"baseSeverity":"MEDIUM","exploitMaturity":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"INCIBE","orgId":"0cbda920-cd7f-484a-8e76-bf7f4b7f4516","dateUpdated":"2025-12-04T11:48:10.112Z"},"credits":[{"lang":"en","type":"finder","value":"Arnau Sola López and Arnau Yepes Huguet"}],"datePublic":"2025-12-04T11:43:00.000Z","solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The vulnerabilities have been fixed by the Seafile team in version 12.0.14.<br>"}],"value":"The vulnerabilities have been fixed by the Seafile team in version 12.0.14."}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.5.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-12-04T14:43:40.156201Z","id":"CVE-2025-41079","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-12-04T14:44:00.913Z"}}]}}}