Seafile Community Edition Stored Cross-Site Scripting Vulnerability via SVG Upload

A stored cross-site scripting vulnerability has been identified in Seafile Community Edition versions prior to 13.0.12. When the Golang file server is enabled, an attacker can upload a malicious SVG file containing JavaScript, share it via a public link, and execute the script in the browser of anyone who opens the link.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where uploaded malicious SVG files execute JavaScript in the context of the user viewing the shared link.

Reproduction

To reproduce this vulnerability, upload a crafted SVG file containing JavaScript into a Seafile Community Edition instance with the Golang file server enabled. Once uploaded, share the file using a public link. When the link is opened, the JavaScript embedded in the SVG will execute in the browser.

Remediation

Users can upgrade to Seafile Community Edition version 13.0.12 or later, where this vulnerability has been fixed.