CVE-2026-85137: SeaCMS Locoy Collector seacms_locoy_news.php parseIf code injection
A security vulnerability has been detected in SeaCMS up to 13.6. This impacts the function parseIf of the file seacmslocoynews.php of the component Locoy Collector. The manipulation of the argument pwd leads to code injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
SeaCMS deployments using the Locoy Collector component are affected if they run SeaCMS version 13.6 or earlier. The vulnerable code is in seacms_locoy_news.php.
Does exploitation require authentication or user interaction?
No. The supplied severity vector indicates network-accessible exploitation with low attack complexity, no privileges, and no user interaction.
What input is involved in the attack?
The issue is triggered by manipulation of the pwd argument passed to the parseIf function. Successful exploitation results in code injection.
How urgent is remediation?
Prioritize remediation because a public exploit has been disclosed and may be used. The reported impact includes low confidentiality, integrity, and availability effects.