CVE-2026-82598: SeaCMS Template search.php parseIf code injection

Q: Which SeaCMS deployments are affected?

SeaCMS versions up to and including 13.6 are affected. The issue is in the Template Engine's parseIf function in search.php.

Q: Can this be exploited remotely without an account?

Yes. The supplied severity vector indicates network-based exploitation with low attack complexity, no privileges, and no user interaction required. The vulnerable searchtype argument is the attack vector.

Q: Is there public exploit information?

Yes. The exploit has been publicly disclosed and may be used by attackers.

Published Aug 31, 2026

Updated

A vulnerability was determined in SeaCMS up to 13.6. Affected is the function parseIf of the file search.php of the component Template Engine. This manipulation of the argument searchtype causes code injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

Affected Software

1 affected component

SeaCMS<=13.6

Event History

Aug 31, 2026

CVE Published

via MITRE·12:30 AM

Data Sourced

via MITRE·12:30 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which SeaCMS deployments are affected?

SeaCMS versions up to and including 13.6 are affected. The issue is in the Template Engine's parseIf function in search.php.

Can this be exploited remotely without an account?

Yes. The supplied severity vector indicates network-based exploitation with low attack complexity, no privileges, and no user interaction required. The vulnerable searchtype argument is the attack vector.

Is there public exploit information?