Seafile Ltd bug bounty programs
seafile.com Updated
Seafile Ltd runs one public program: a Sorona bug bounty paying up to $1,500.
- Top reward
- $1,500
- Sorona
- Programs
- 1
- 1 pays cash
- Targets in scope
- 12
- 2 types
- Last change
- None yet
- Tracked since Nov 2026
Where to report
The one public program Seafile Ltd runs.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Seafile
Sorona · Bug bounty |
– | – | – | $100 | $1,500 | Partial | – | – | Open |
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100
- Safe harbor
- Partial
Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
12 targets. 6 excluded.
-
https://www.seafile.com
Web
-
Authentication and session handling, including the LDAP and Active Directory wiring and any SSO the deployment uses
Products and areas
-
File preview and office document conversion, which run parsers over files an untrusted user uploaded
Products and areas
-
Group and organisation membership, plus the multi-tenant separation on installs that host more than one department
Products and areas
-
SeaDoc, the collaborative editor, and the desktop and mobile clients
Products and areas
-
Seahub, the Django web application, and every view and API endpoint in it
Products and areas
-
The library sharing model in full: share links, share passwords, expiry, upload links and shares between users and groups
Products and areas
-
The policy declares scope in a single sentence: the community server, any open-source codebase Seafile Ltd maintains, and the commercial offerings. Nothing is carved out
Products and areas
-
The storage daemon written in C, and the block and object handling it performs on data the sync protocol delivers
Products and areas
-
The sync protocol between the server and the desktop clients, which is the path most of the traffic on any real install takes
Products and areas
-
The system administration panel and every setting it changes on a running server
Products and areas
-
The WebDAV endpoint and the REST API that scripted consumers and third-party clients authenticate against
Products and areas
No target matches. Try part of a host name, such as the company name.
Out of scope 6
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
Attacks requiring physical access to the host
-
Deployment configuration: reverse-proxy setup, storage backend permissions and a server exposed without TLS
-
Reports filed as public GitHub issues, which disclose the finding before a fix exists
-
The policy names no exclusions at all, so nothing is ruled out in writing. What follows are genuine out-of-scope classes rather than a quoted policy position
-
Third-party integrations and the services behind them
-
Upstream Django, Python and library defects, unless Seafile's own use of them is what makes the issue reachable
Recent changes
Reward and scope changes across every Seafile Ltd program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in Seafile Ltd products, from the NVD.
-
CVE-2026-30587 High
Multiple Stored XSS vulnerabilities exist in Seafile Server version 13.0.15,13.0.16-pro,12.0.14 and prior and fixed in 13.0.17, 13.0.17-pro, and 12.0.20-pro, via the Seadoc (sdoc) editor. The application fails to properly sanitize WebSocket messages regarding document structure updates. This allows authenticated remote attackers to inject malicious JavaScript payloads via the src attribute of embe
-
CVE-2025-65516 Medium
A stored cross-site scripting (XSS) vulnerability was discovered in Seafile Community Edition prior to version 13.0.12. When Seafile is configured with the Golang file server, an attacker can upload a crafted SVG file containing malicious JavaScript and share it using a public link. Opening the link triggers script execution in the victim's browser. This issue has been fixed in Seafile Community E
-
CVE-2025-41080 Medium
A stored Cross-Site Scripting (XSS) vulnerability has been found in Seafile v12.0.10. This vulnerability allows an attacker to execute arbitrary code in the victim's browser by storing malicious payloads with POST parámetro 'p' in '/api/v2.1/repos/{repo_id}/file/'.
-
CVE-2025-41079 Medium
A stored Cross-Site Scripting (XSS) vulnerability has been found in Seafile v12.0.10. This vulnerability allows an attacker to execute arbitrary code in the victim's browser by storing malicious payloads with PUT parámetro 'name' in '/api/v2.1/user/'.
-
CVE-2023-28873 Medium
An XSS issue in wiki and discussion pages in Seafile 9.0.6 allows attackers to inject JavaScript into the Markdown editor.
-
CVE-2023-28874 Medium
The next parameter in the /accounts/login endpoint of Seafile 9.0.6 allows attackers to redirect users to arbitrary sites.
-
CVE-2021-43820 High
Seafile is an open source cloud storage system. A sync token is used in Seafile file syncing protocol to authorize access to library data. To improve performance, the token is cached in memory in seaf-server. Upon receiving a token from sync client or SeaDrive client, the server checks whether the token exist in the cache. However, if the token exists in cache, the server doesn't check whether it'
-
CVE-2021-30146 Medium
Seafile 7.0.5 (2019) allows Persistent XSS via the "share of library functionality."
About this page
This page gathers every public program listed under seafile.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.