CVE-2026-82603: Path Traversal in SeaCMS

This vulnerability in SeaCMS up to version 13.6 allows an attacker to perform path traversal by manipulating the itype/vid parameter in the /member.php?action=del_pl file within the Comment Cache component. The flaw enables unauthorized access to files outside the intended directory structure. The attack can be launched remotely without user interaction and requires low privileges. Public exploit code exists, but there is no official patch or remediation level provided by the vendor at this time.

Successful exploitation of this vulnerability could allow an attacker to read or access files outside the intended directory, potentially exposing sensitive information. The vulnerability requires low privileges and no user interaction, making remote exploitation feasible. However, the overall impact is rated medium due to limited scope and no indication of privilege escalation or code execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict access to the vulnerable endpoint, implement web application firewall (WAF) rules to detect and block path traversal attempts targeting the itype/vid parameter, and monitor for exploitation attempts. Avoid exposing the affected component to untrusted networks if possible.