# CVE-2026-82599: SeaCMS arbitrary file deletion in avatar upload

Source: https://junglewise.ai/threats/cve-2026-82599-seacms-arbitrary-file-deletion-in-avatar-upload  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82599 · Severity: medium · CVSS 5.4 · Published 2026-08-31

SeaCMS is a content management system that allows authenticated users to upload profile avatars. A flaw in the avatar upload feature allows an authenticated attacker to delete arbitrary files on the server by crafting a malicious file path in the upload request, potentially leading to data loss or system compromise if critical files are targeted.

Technologies: [Seacms](https://junglewise.ai/threats/technologies/seacms). Vendors: [Seacms](https://junglewise.ai/threats/vendors/seacms).

## Quick answers

**Is CVE-2026-82599 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82599 being exploited in the wild.

**How severe is CVE-2026-82599?** Medium severity, with a CVSS score of 5.4, published 31 August 2026.

**Which products and versions are affected?** Seacms up to 13.6.

**Is there a fix for CVE-2026-82599?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-82599 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-82599?** Check whether you run Seacms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a path traversal vulnerability combined with arbitrary file deletion in SeaCMS 13.6's member avatar upload functionality (/member.php?action=chgpwdsubmit). The vulnerable component fails to validate or sanitize the oldpic parameter before passing it directly to PHP's unlink() function. An authenticated, low-privileged member can bypass the deletion restriction by uploading a valid image while specifying a malicious oldpic path containing traversal sequences (e.g., ../../ or absolute paths), allowing deletion of files outside the intended uploads/user/ directory. The vulnerability requires the avatar upload feature to be enabled (cfg_upic='1') and an authenticated session; no additional user interaction is required. An attacker can delete arbitrary files writable by the web process, including application files, configuration files, or other user data.

## Affected products

- SeaCMS SeaCMS up to 13.6

## Timeline

- 2026-08-31: disclosed
- other: Public exploit available

## References

- [https://github.com/T-Chachamaru/seacms-13.6-security-advisories/blob/a084a3e573240d54860153321df271280daec262/c-002b-member-oldpic-file-deletion.md](https://github.com/T-Chachamaru/seacms-13.6-security-advisories/blob/a084a3e573240d54860153321df271280daec262/c-002b-member-oldpic-file-deletion.md)
- [https://vuldb.com/cve/CVE-2026-82599](https://vuldb.com/cve/CVE-2026-82599)

## Related threats

- [SeaCMS SQL injection in comment API](https://junglewise.ai/threats/cve-2019-25778-seacms-through-8-7-contains-an-unauthenticated-sql-injection)
- [SeaCMS authenticated remote code execution in admin_config.php](https://junglewise.ai/threats/cve-2026-79423-seacms-authenticated-remote-code-execution-in-admin-config-php)
- [SeaCMS WeChat Module SQL injection via XML entity decoding](https://junglewise.ai/threats/cve-2026-85138-seacms-wechat-module-sql-injection-via-xml-entity-decoding)
- [SeaCMS Locoy Collector code injection via default password](https://junglewise.ai/threats/cve-2026-85137-seacms-locoy-collector-code-injection-via-default-password)
- [SeaCMS path traversal in member.php comment deletion](https://junglewise.ai/threats/cve-2026-82603-seacms-path-traversal-in-member-php-comment-deletion)