CVE-2026-85137: Code Injection in SeaCMS

CVE-2026-85137 is a code injection vulnerability affecting SeaCMS versions 13.0 to 13.6. The flaw exists in the parseIf function of the seacms_locoy_news.php file in the Locoy Collector component. An attacker can remotely manipulate the pwd argument to inject and execute arbitrary code. The vulnerability is remotely exploitable without requiring privileges or user interaction. Although public exploit information is available, there is no vendor advisory or official fix published at this time.

Successful exploitation allows remote attackers to execute arbitrary code on affected SeaCMS installations, potentially leading to full system compromise or unauthorized control of the CMS environment. The vulnerability does not require authentication or user interaction, increasing its risk. However, the CVSS score of 6.9 reflects that some conditions may limit impact or exploitability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the vulnerable component and monitor for suspicious activity related to the pwd argument. Avoid exposing the vulnerable endpoint to untrusted networks where possible.