Remote Code Injection in SeaCMS Template Engine

SeaCMS versions up to 13.6 are vulnerable to a remote code injection vulnerability located within the Template Engine component. The flaw resides in the 'parseIf' function within the 'search.php' file. An unauthenticated remote attacker can exploit this by sending a crafted HTTP request that manipulates the 'searchtype' argument. Successful exploitation allows for the execution of arbitrary code on the underlying web server, potentially leading to full system compromise. This vulnerability has been publicly disclosed and is considered actively exploitable, posing a high risk to organizations utilizing this content management system.

Impact

Successful exploitation of CVE-2026-82598 allows an attacker to achieve remote code execution (RCE) on the host web server. This can lead to unauthorized data access, system disruption, modification of web content, or further movement into the internal network. Given the prevalence of CMS vulnerabilities, this flaw is likely to be targeted by automated scanners and automated exploit scripts.

Recommendation

Prioritize the immediate remediation of all SeaCMS installations. If an official patch is available from the vendor, apply it immediately. If no patch is available, ensure the web application is behind a Web Application Firewall (WAF) configured to inspect HTTP parameters for malicious payloads.

• Identify and audit all web servers running SeaCMS 13.6 or earlier.
• Configure WAF rules to sanitize or block input to the 'searchtype' parameter in 'search.php' that contains suspicious characters or script tags.
• Monitor web server logs for suspicious POST requests targeting 'search.php' with unusual 'searchtype' parameters.