Seafile Security Updates: Fixes for FileRevision API, Shared Link SSRF/Bypass, and JWT Auth Issues

Vulnerability Overview 13.0.24 (2026-06-09) - Fixed the file download issue in the Android client. 13.0.23 (2026-06-08) - Fixed the shared link download vulnerability. - Fixed the FileRevision API vulnerability. - Fixed the file search vulnerability. - Fixed the vulnerability via media shared links. - Fixed security issues in the Go file server. - Fixed incorrect file deletion timestamps in the trash page. - Fixed consistency between directory permission timestamp cache and the database. - Added an option to enable or disable profile configuration features. 13.0.22 (2026-05-29) - Fixed import errors in Wiki. - Fixed the read-only permission check error for JWT tokens. - Fixed the invisible expand button in the top bar. - Improved GC progress logging during long-running processes. 13.0.21 (2026-04-20) - Fixed the issue with multi-selection via the Shift key in shared links. - Fixed the Redis reconnection bug in metadata processing. - Fixed the issue where the cookie was not set for Shibboleth authentication. Affected Scope 13.0.24 - Android client users. 13.0.23 - All Seafile users, particularly those involved in file sharing, API calls, file search, media shared links, Go file server operations, trash page management, directory permission management, and profile configuration features. 13.0.22 - Users utilizing Wiki, JWT tokens, top bar features, and long-running GC processes. 13.0.21 - Users utilizing shared links, Redis reconnection functionality, and Shibboleth authentication. Remediation Steps 13.0.24 - Fixed the file download issue in the Android client. 13.0.23 - Fixed the shared link download vulnerability. - Fixed the FileRevision API vulnerability. - Fixed the file search vulnerability. - Fixed the vulnerability via media shared links. - Fixed security issues in the Go file server. - Fixed incorrect file deletion timestamps in the trash page. - Fixed consistency between directory permission timestamp cache and the database. - Added an option to enable or disable profile configuration features. 13.0.22 - Fixed import errors in Wiki. - Fixed the read-only permission check error for JWT tokens. - Fixed the invisible expand button in the top bar. - Improved GC progress logging during long-running processes. 13.0.21 - Fixed the issue with multi-selection via the Shift key in shared links. - Fixed the Redis reconnection bug in metadata processing. - Fixed the issue where the cookie was not set for Shibboleth authentication. POC Code or Exploit Code No specific POC code or exploit code is included in this report.

Goal Reached Thanks to every supporter — we hit 100%!

Seafile Security Updates: Fixes for FileRevision API, Shared Link SSRF/Bypass, and JWT Auth Issues