Seafile

12 CVEs across 4 Seafile products. Browse Seafile vulnerabilities, severities, and proof-of-concept exploits.

Seafile products with known CVEs

ProductCVEs
Seafile6
Seafile Server4
Seadroid1
Seafile-Client1
Seafile CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-30587High8.72026-03-25Multiple Stored XSS vulnerabilities exist in Seafile Server version 13.0.15,13.0.16-pro,12.0.14 and prior and fixed in 13.0.17, 13.0.17-pro, and 12.0.20-pro, v…
CVE-2025-65516Medium6.12025-12-04A stored cross-site scripting (XSS) vulnerability was discovered in Seafile Community Edition prior to version 13.0.12. When Seafile is configured with the Gol…
CVE-2025-41080Medium6.12025-12-04A stored Cross-Site Scripting (XSS) vulnerability has been found in Seafile v12.0.10. This vulnerability allows an attacker to execute arbitrary code in the vi…
CVE-2025-41079Medium6.12025-12-04A stored Cross-Site Scripting (XSS) vulnerability has been found in Seafile v12.0.10. This vulnerability allows an attacker to execute arbitrary code in the vi…
CVE-2023-28874Medium6.12023-12-09The next parameter in the /accounts/login endpoint of Seafile 9.0.6 allows attackers to redirect users to arbitrary sites.
CVE-2023-28873Medium5.42023-12-09An XSS issue in wiki and discussion pages in Seafile 9.0.6 allows attackers to inject JavaScript into the Markdown editor.
CVE-2021-43820High7.42021-12-14Seafile is an open source cloud storage system. A sync token is used in Seafile file syncing protocol to authorize access to library data. To improve performan…
CVE-2021-30146Medium5.42021-04-06Seafile 7.0.5 (2019) allows Persistent XSS via the "share of library functionality."
CVE-2020-16143High7.82020-07-29The seafile-client client 7.0.8 for Seafile is vulnerable to DLL hijacking because it loads exchndl.dll from the current working directory.
CVE-2013-7469High7.52019-02-21Seafile through 6.2.11 always uses the same Initialization Vector (IV) with Cipher Block Chaining (CBC) Mode to encrypt private data, making it easier to condu…
CVE-2019-8919High7.52019-02-18The seadroid (aka Seafile Android Client) application through 2.2.13 for Android always uses the same Initialization Vector (IV) with Cipher Block Chaining (CB…
CVE-2014-5443High7.82018-03-19Seafile Server before 3.1.2 and Server Professional Edition before 3.1.0 allow local users to gain privileges via vectors related to ccnet handling user accoun…