A vulnerability was identified in SeaCMS up to 13.6. (CVE-2026-82599)

SeaCMS versions up to 13.6 contain a path traversal vulnerability (CWE-22) in the unlink function within /member.php?action=chgpwdsubmit related to the Avatar Upload component. The vulnerability arises from improper validation of the 'oldpic' parameter, allowing remote attackers with limited privileges to manipulate file paths and potentially delete arbitrary files. The vulnerability can be exploited remotely without user interaction. Public exploit code exists, but there are no reports of exploitation in the wild. The CVSS v3.1 base score is 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L), reflecting low severity with impact on integrity and availability.

The vulnerability allows remote attackers with limited privileges to perform path traversal attacks via the 'oldpic' argument, potentially leading to unauthorized deletion of files. This impacts the integrity and availability of the affected system. There is no confidentiality impact reported. No active exploitation in the wild has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, restrict access to the affected functionality and monitor for attempts to exploit the 'oldpic' parameter. Avoid using publicly exposed instances without proper access controls.