CVE-2026-82598: Code Injection in SeaCMS

This vulnerability affects SeaCMS up to version 13.6 in the parseIf function of the search.php file, part of the Template Engine component. By manipulating the searchtype argument, an attacker can perform code injection remotely. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity level. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported at this time.

Successful exploitation allows remote code injection, potentially enabling an attacker to execute arbitrary code within the context of the SeaCMS application. This could lead to unauthorized actions depending on the privileges of the application process. The CVSS score of 6.9 reflects a medium impact with network attack vector and no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch information is provided, users should monitor vendor communications for updates. Until a patch is available, consider restricting access to the affected component or applying application-level input validation to mitigate injection risks.