CVE-2026-82603: SeaCMS Comment Cache member.php del_pl path traversal
A vulnerability was detected in SeaCMS up to 13.6. This issue affects some unknown processing of the file /member.php?action=delpl of the component Comment Cache. The manipulation of the argument itype/vid results in path traversal. The attack may be launched remotely. The exploit is now public and may be used.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
The vulnerability can be exploited remotely, but the severity vector indicates that the attacker needs low-level privileges. No user interaction is required.
Which deployments should be considered exposed?
SeaCMS versions up to 13.6 should be considered potentially affected where the Comment Cache deletion endpoint at /member.php?action=del_pl is reachable by a low-privileged authenticated user.
What is the likely impact of successful exploitation?
The reported path traversal affects the itype and vid arguments and is rated for low integrity and availability impact. The supplied data does not confirm confidentiality impact.
How urgent is remediation?
Prioritize remediation because a public exploit is available and exploitation is assessed as technically straightforward. The supplied data does not identify a fixed version.