CVE-2026-82598: Code Injection in SeaCMS

SeaCMS up to version 13.6 contains a code injection vulnerability in the parseIf function of the search.php file within the Template Engine component. This vulnerability arises from improper handling of the searchtype argument, which can be manipulated remotely to inject and execute arbitrary code. The vulnerability is identified as CVE-2026-82598 and has been publicly disclosed. The CVSS v3.1 base score is 6.9, reflecting a moderate impact with network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to inject and execute arbitrary code on the affected system. This could lead to unauthorized actions within the application context, potentially compromising the integrity and availability of the system. However, no active exploitation in the wild has been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix has been provided, users should monitor vendor communications for updates. Until a fix is available, consider restricting access to the vulnerable component or applying application-level input validation to mitigate the risk of code injection via the searchtype parameter.