Quick answers
- Is CVE-2026-82601 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-82601 being exploited in the wild.
- How severe is CVE-2026-82601?
- Medium severity, with a CVSS score of 4.3, published 31 August 2026.
- Which products and versions are affected?
- Seacms up to 13.6.
- Is there a fix for CVE-2026-82601?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-82601 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-82601?
- Check whether you run Seacms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A reflected XSS vulnerability exists in SeaCMS 13.6's /err.php file where the errtxt GET parameter is echoed directly into an HTML textarea element without proper output encoding. The vulnerable code at line 122 outputs the parameter using echo without htmlspecialchars() escaping. An attacker can craft a malicious URL with payload such as </textarea><iframe src="javascript:..."> to break out of the textarea context and inject executable HTML/JavaScript. The attack requires user interaction (victim must visit the crafted link) but no authentication. While the default web application firewall blocks simple <script> tags, it does not prevent all executable HTML contexts like iframe with javascript: protocol handlers.
Affected products
- SeaCMS SeaCMS up to 13.6
Timeline
- 2026-08-31: disclosed
- other: Exploit proof-of-concept publicly available