CVE-2026-82599: SeaCMS Avatar Upload member.php unlink path traversal
A vulnerability was identified in SeaCMS up to 13.6. Affected by this vulnerability is the function unlink of the file /member.php?action=chgpwdsubmit of the component Avatar Upload. Such manipulation of the argument oldpic leads to path traversal. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
Affected Software
Event History
Frequently Asked Questions
Which SeaCMS deployments should be considered exposed?
SeaCMS versions up to and including 13.6 are identified as affected. The issue is in the avatar-upload functionality reached through member.php?action=chgpwdsubmit.
What access does an attacker need?
The attack can be launched remotely over the network, but it requires low-level privileges. Exploitation involves manipulating the oldpic argument used by the password-change submission handler.
How likely is exploitation in practice?
A public exploit is available and may be used. The supplied severity information rates the issue medium, with potential integrity and availability impact but no stated confidentiality impact.