CVE-2026-82603: SeaCMS Comment Cache member.php del_pl path traversal

Q: Who can exploit this issue?

The vulnerability can be exploited remotely, but the severity vector indicates that the attacker needs low-level privileges. No user interaction is required.

Q: Which deployments should be considered exposed?

SeaCMS versions up to 13.6 should be considered potentially affected where the Comment Cache deletion endpoint at /member.php?action=del_pl is reachable by a low-privileged authenticated user.

Q: What is the likely impact of successful exploitation?

The reported path traversal affects the itype and vid arguments and is rated for low integrity and availability impact. The supplied data does not confirm confidentiality impact.

Q: How urgent is remediation?

Prioritize remediation because a public exploit is available and exploitation is assessed as technically straightforward. The supplied data does not identify a fixed version.

Published Aug 31, 2026

Updated

A vulnerability was detected in SeaCMS up to 13.6. This issue affects some unknown processing of the file /member.php?action=delpl of the component Comment Cache. The manipulation of the argument itype/vid results in path traversal. The attack may be launched remotely. The exploit is now public and may be used.

Affected Software

1 affected component

SEACMS SEACMS<=13.6

Event History

Aug 31, 2026

CVE Published

via MITRE·01:45 AM

Data Sourced

via MITRE·01:45 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

The vulnerability can be exploited remotely, but the severity vector indicates that the attacker needs low-level privileges. No user interaction is required.

Which deployments should be considered exposed?

SeaCMS versions up to 13.6 should be considered potentially affected where the Comment Cache deletion endpoint at /member.php?action=del_pl is reachable by a low-privileged authenticated user.

What is the likely impact of successful exploitation?

The reported path traversal affects the itype and vid arguments and is rated for low integrity and availability impact. The supplied data does not confirm confidentiality impact.

How urgent is remediation?

Prioritize remediation because a public exploit is available and exploitation is assessed as technically straightforward. The supplied data does not identify a fixed version.

CVE-2026-82603: SeaCMS Comment Cache member.php del_pl path traversal

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

Which deployments should be considered exposed?

What is the likely impact of successful exploitation?

How urgent is remediation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which deployments should be considered exposed?

What is the likely impact of successful exploitation?

How urgent is remediation?