Cover

Security fixes

In this page, we documents security fixes in Seafile.
13.0
13.0.28 (2026-09-18)
  • Fix batch write permission vulnerability for read-only repository API tokens. Thanks to Mike Jenkinson for reporting the issue
  • Updated JS frontend dependencies with known security vulnerabilities.
13.0.27 (2026-08-19)
  • Fix SAML-related vulnerability for user authentication. Thanks to William Lin for reporting the issue. The CVE ID is pending application. You may track the application status via tracking number CAN-2026-2034155.
13.0.25 (2026-07-03)
  • Fix permission check in File/Dir revert API, FileRevision API, and Metadata API. Thanks to Christophe Neuerburg for reporting this issue and providing valid code
  • Fix an issue where deactivated users could still authenticate normally via WebDAV password.
13.0.23 (2026-06-08)
  • Fix shared link download vulnerability. Thanks to George Chen for reporting the issue.
  • Fix FileRevision API vulnerability. Thanks to Rachel Fragile for reporting the issue.
  • Fix search vulnerability. Thanks to Rachel Fragile for reporting the issue.
  • Fix view-media-via-share-link link vulnerability. Thanks to Rachel Fragile for reporting the issue.
  • Fix security issues in Go fileserver. Thanks to Francisco Garcia for reporting the issue.
13.0.22 (2026-05-29)
  • Fix a read-only permission check error for exdraw JWT token. Thanks to Florian Eichelberger for reporting the issue.
  • Fix permission leakage vulnerability of invisible directories. Thanks to Christophe Neuerburg for reporting the issue.
13.0.18 (2026-02-05)
  • Remove old API that downloads a file via share link token which cause security issues. Thanks to Sho Odagiri for reporting the issue.
  • Fix import seadoc not checking CSRF token. Thanks to Sho Odagiri for reporting the issue.
13.0.17 (2026-02-03)
  • Fix a stored XSS problem in sdoc link element. Thanks to Paolo Gabriele Schiraldi for reporting the issue.
  • Fix read-only permission check for sdoc. Thanks to Sho Odagiri for reporting the issue.
  • Fix guest invitation can activate a normal inactive user.
13.0.12 (2025-10-24)
  • Fix a XSS issue for SVG file view in sharing link when the Golang file server is used. Thanks to Jose Alfredo Bukit for reporting the issue.
13.0.9 beta (2025-08-28)
  • Fix a XSS issue in upload link.
  • Update Django to version 5.2.
13.0.7 beta (2025-07-14)
  • For security reasons, WebDAV no longer supports login with LDAP accounts; LDAP users must generate a WebDAV token on the profile page.