CVE-2026-82599: Path Traversal in SeaCMS

CVE-2026-82599 is a path traversal vulnerability affecting SeaCMS versions 13.0 to 13.6. The flaw exists in the unlink function of the /member.php?action=chgpwdsubmit endpoint, specifically in the Avatar Upload component. By manipulating the 'oldpic' parameter, an attacker can traverse directories and potentially delete arbitrary files. The vulnerability is remotely exploitable without user interaction and requires low privileges. Public exploit code is available, but no official patch or remediation guidance has been provided as of the publication date.

Successful exploitation allows remote attackers with limited privileges to perform path traversal via the 'oldpic' parameter, potentially deleting arbitrary files on the server. This could lead to denial of service or other impacts depending on the files affected. The vulnerability does not require user interaction and has a medium severity level (CVSS 5.3). No known active exploitation in the wild has been reported.

No official patch or remediation has been confirmed at this time. Users should monitor vendor advisories for updates. In the absence of an official fix, restricting access to the vulnerable endpoint and validating or sanitizing input parameters may reduce risk. Since exploit code is publicly available, cautious exposure of the affected functionality is advised.