- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 12
- Public CVEs
- 12
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
- Hall of fame
-
No
No credit is promised anywhere, so ask for it explicitly if you want it
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
12 assets you may test, 6 excluded.
Web 1
- https://www.seafile.com
Products and areas 11
- Authentication and session handling, including the LDAP and Active Directory wiring and any SSO the deployment uses
- File preview and office document conversion, which run parsers over files an untrusted user uploaded
- Group and organisation membership, plus the multi-tenant separation on installs that host more than one department
- SeaDoc, the collaborative editor, and the desktop and mobile clients
- Seahub, the Django web application, and every view and API endpoint in it
- The library sharing model in full: share links, share passwords, expiry, upload links and shares between users and groups
- The policy declares scope in a single sentence: the community server, any open-source codebase Seafile Ltd maintains, and the commercial offerings. Nothing is carved out
- The storage daemon written in C, and the block and object handling it performs on data the sync protocol delivers
- The sync protocol between the server and the desktop clients, which is the path most of the traffic on any real install takes
- The system administration panel and every setting it changes on a running server
- The WebDAV endpoint and the REST API that scripted consumers and third-party clients authenticate against
Out of scope (6)
- Attacks requiring physical access to the host
- Deployment configuration: reverse-proxy setup, storage backend permissions and a server exposed without TLS
- Reports filed as public GitHub issues, which disclose the finding before a fix exists
- The policy names no exclusions at all, so nothing is ruled out in writing. What follows are genuine out-of-scope classes rather than a quoted policy position
- Third-party integrations and the services behind them
- Upstream Django, Python and library defects, unless Seafile's own use of them is what makes the issue reachable
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy. "We" in these lines means Sorona, not this site.
While testing
-
Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly.
-
Email the address on the policy page . It is a general-purpose inbox rather than a security alias, and it is the only address the policy gives
-
GitHub private vulnerability reporting is switched off on both haiwen/seafile and haiwen/seahub , so the advisory button is not an option here
-
agree a publication date with the vendor in writing before you assume one and do not treat silence as consent to disclose
Not accepted
-
Upstream Django, Python and library defects, unless Seafile's own use of them is what makes the issue reachable
-
Deployment configuration: reverse-proxy setup, storage backend permissions and a server exposed without TLS
-
Third-party integrations and the services behind them
-
Attacks requiring physical access to the host
-
Reports filed as public GitHub issues, which disclose the finding before a fix exists
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 22 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-30587 | Multiple Stored XSS vulnerabilities exist in Seafile Server version 13.0.15,13.0.16-pro,12.0.14 and prior and fixed in 13.0.17, 13.0.17-pro, and 12.0.20-pro, via the Seadoc (sdoc) editor. The application fails to properly sanitize WebSocket messages regarding document structure updates. This allows authenticated remote attackers to inject malicious JavaScript payloads via the src attribute of embe | High 8.7 | 25 Mar 2026 |
| CVE-2025-65516 | A stored cross-site scripting (XSS) vulnerability was discovered in Seafile Community Edition prior to version 13.0.12. When Seafile is configured with the Golang file server, an attacker can upload a crafted SVG file containing malicious JavaScript and share it using a public link. Opening the link triggers script execution in the victim's browser. This issue has been fixed in Seafile Community E | Medium 6.1 | 4 Dec 2025 |
| CVE-2025-41080 | A stored Cross-Site Scripting (XSS) vulnerability has been found in Seafile v12.0.10. This vulnerability allows an attacker to execute arbitrary code in the victim's browser by storing malicious payloads with POST parámetro 'p' in '/api/v2.1/repos/{repo_id}/file/'. | Medium 5.1 | 4 Dec 2025 |
| CVE-2025-41079 | A stored Cross-Site Scripting (XSS) vulnerability has been found in Seafile v12.0.10. This vulnerability allows an attacker to execute arbitrary code in the victim's browser by storing malicious payloads with PUT parámetro 'name' in '/api/v2.1/user/'. | Medium 5.1 | 4 Dec 2025 |
| CVE-2023-28873 | An XSS issue in wiki and discussion pages in Seafile 9.0.6 allows attackers to inject JavaScript into the Markdown editor. | Medium 5.4 | 9 Dec 2023 |
| CVE-2023-28874 | The next parameter in the /accounts/login endpoint of Seafile 9.0.6 allows attackers to redirect users to arbitrary sites. | Medium 6.1 | 9 Dec 2023 |
| CVE-2021-43820 | Seafile is an open source cloud storage system. A sync token is used in Seafile file syncing protocol to authorize access to library data. To improve performance, the token is cached in memory in seaf-server. Upon receiving a token from sync client or SeaDrive client, the server checks whether the token exist in the cache. However, if the token exists in cache, the server doesn't check whether it' | High 7.4 | 14 Dec 2021 |
| CVE-2021-30146 | Seafile 7.0.5 (2019) allows Persistent XSS via the "share of library functionality." | Medium 5.4 | 6 Apr 2021 |
| CVE-2020-16143 | The seafile-client client 7.0.8 for Seafile is vulnerable to DLL hijacking because it loads exchndl.dll from the current working directory. | High 7.8 | 29 Jul 2020 |
| CVE-2013-7469 | Seafile through 6.2.11 always uses the same Initialization Vector (IV) with Cipher Block Chaining (CBC) Mode to encrypt private data, making it easier to conduct chosen-plaintext attacks or dictionary attacks. | High 7.5 | 21 Feb 2019 |
| CVE-2019-8919 | The seadroid (aka Seafile Android Client) application through 2.2.13 for Android always uses the same Initialization Vector (IV) with Cipher Block Chaining (CBC) Mode to encrypt private data, making it easier to conduct chosen-plaintext attacks or dictionary attacks. | High 7.5 | 18 Feb 2019 |
| CVE-2014-5443 | Seafile Server before 3.1.2 and Server Professional Edition before 3.1.0 allow local users to gain privileges via vectors related to ccnet handling user accounts. | High 7.8 | 19 Mar 2018 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 5 Last 12 months Access control 35 % Info disclosure 25 % Auth 20 % Memory safety 20 % Latest advisories Loading the feed Overview Seafile is a self-hosted file sync and share server, a C storage daemon under a Django web front end. Its footprint is institutional: several European universities name themselves as users on the vendor's own homepage, alongside Kaspersky, and the community image carries around 19 million pulls. Five CVEs came out of the whole project in the last twelve months, one high and four medium, and against an estate that size the number reads as reports failing to arrive rather than as a clean codebase. The only published disclosure path is a footer link to a ninety-word policy pointing at a general info@ inbox. No bounty language appears anywhere on it, so sorona.xyz pays you directly on qualified, reproduced findings. In scope The policy declares scope in a single sentence: the community server, any open-source codebase Seafile Ltd maintains, and the commercial offerings. Nothing is carved out The storage daemon written in C, and the block and object handling it performs on data the sync protocol delivers The sync protocol between the server and the desktop clients, which is the path most of the traffic on any real install takes Seahub, the Django web application, and every view and API endpoint in it The library sharing model in full: share links, share passwords, expiry, upload links and shares between users and groups Group and organisation membership, plus the multi-tenant separation on installs that host more than one department Authentication and session handling, including the LDAP and Active Directory wiring and any SSO the deployment uses The WebDAV endpoint and the REST API that scripted consumers and third-party clients authenticate against File preview and office document conversion, which run parsers over files an untrusted user uploaded The system administration panel and every setting it changes on a running server SeaDoc, the collaborative editor, and the desktop and mobile clients Out of scope The policy names no exclusions at all, so nothing is ruled out in writing. What follows are genuine out-of-scope classes rather than a quoted policy position Upstream Django, Python and library defects, unless Seafile's own use of them is what makes the issue reachable Deployment configuration: reverse-proxy setup, storage backend permissions and a server exposed without TLS Third-party integrations and the services behind them Attacks requiring physical access to the host Reports filed as public GitHub issues, which disclose the finding before a fix exists Most-valued findings Anything crossing a library or group boundary. On a server holding a university department's shared research storage, one account reading another's library is the entire risk Share link handling: a token that survives revocation or expiry, or a password-protected link that gives up its content without the password Unauthenticated reach into Seahub views or the REST API, the class with the highest ceiling given the size and sensitivity of the estate Memory safety in the C storage daemon, which parses block and object data delivered by the sync protocol from any client that can authenticate Authentication defects, particularly an LDAP or Active Directory bind that accepts an identity or a credential it should reject on an install wired into a university directory File preview and document conversion, where an uploaded file drives a parser running server side with the server's own authority Anything at all, given the ratio. Nineteen million container pulls against five CVEs a year describes a channel almost nobody is using, and the intake is a general inbox behind a footer link Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Email [email protected] . It is a general-purpose inbox rather than a security alias, and it is the only address the policy gives The policy is reachable only from the seafile.com homepage footer, at /en/responsible_disclosure_policy/. There is no security.txt, no page under /en/security/ and no SECURITY.md in any haiwen repository GitHub private vulnerability reporting is switched off on both haiwen/seafile and haiwen/seahub , so the advisory button is not an option here The declared scope is the community server, any open-source codebase Seafile Ltd maintains, and the commercial offerings. Nothing is named out Expect a cold channel: no PGP key, no acknowledgement commitment, no scope detail and no response time. Write for a reader who has not triaged a security report this week No credit is promised anywhere, so ask for it explicitly if you want it Disclosure There is no coordinated process written down. No GitHub advisory has ever been published on either repository, and findings surface as NVD entries alongside a release. Nothing states an embargo, an acknowledgement window or a credit practice, so agree a publication date with the vendor in writing before you assume one and do not treat silence as consent to disclose. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability