CVE-2026-82603: Path Traversal in SeaCMS

This vulnerability in SeaCMS (versions 13.0 through 13.6) involves improper handling of the itype/vid argument in the /member.php?action=del_pl file within the Comment Cache component. An attacker can exploit this flaw to perform a path traversal attack, potentially accessing unauthorized files on the server. The vulnerability is remotely exploitable without user interaction and has a CVSS v3.1 base score of 5.3 (medium severity). Public exploit code is available, but there are no known exploits observed in the wild. No official patch or fix information is provided.

Successful exploitation of this vulnerability allows an attacker to perform path traversal, which may lead to unauthorized access to files on the server. This can compromise confidentiality and potentially aid further attacks depending on the files accessed. The vulnerability requires low attack complexity and no user interaction, but does require some privileges (PR:L).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is referenced, users should monitor vendor channels for updates. In the meantime, restricting access to the vulnerable endpoint and validating input parameters may reduce risk.