Dashboard / CVE-2025-65516

CVE-2025-65516

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 62/100
Published: 2025-12-04 Modified: 2026-11-04 First seen: 2026-11-04 Status: active

Attack Surface

Network Low Complexity No Auth Scope Change

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: Required
S: Changed
C: Low
I: Low
A: None

Description

A stored cross-site scripting (XSS) vulnerability was discovered in Seafile Community Edition prior to version 13.0.12. When Seafile is configured with the Golang file server, an attacker can upload a crafted SVG file containing malicious JavaScript and share it using a public link. Opening the link triggers script execution in the victim's browser. This issue has been fixed in Seafile Community Edition 13.0.12.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
seafile seafile_server < 13.0.12

References & Advisories (2)

Bug Bounty Relevance

62 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity

CVSS Score

6.1 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS — Exploitation Probability

0.24%
Raw Score 0.002390
Percentile 15.0%
Date 2026-11-08

EPSS Trend

2026-11-08
0.00239
2026-11-07
0.00239
2026-11-06
0.00239
2026-11-05
0.00239
2026-11-04
0.00239

Intelligence Sources

nvd ref →

External Links