Quick answers
- Is CVE-2026-82603 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-82603 being exploited in the wild.
- How severe is CVE-2026-82603?
- Medium severity, with a CVSS score of 5.4, published 31 August 2026.
- Which products and versions are affected?
- Seacms up to 13.6.
- Is there a fix for CVE-2026-82603?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-82603 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-82603?
- Check whether you run Seacms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a path traversal / arbitrary file deletion flaw (CWE-22, CWE-73) in SeaCMS 13.6's member.php file at the action=del_pl endpoint. The itype and vid request parameters are concatenated directly into a file path without normalization or boundary validation, allowing a low-privileged authenticated member to traverse directories (e.g., via ../../../uploads/) and delete .js files outside the intended cache directory. An attacker constructs a malicious request with path traversal sequences in the itype/vid parameters to delete arbitrary files writable by the web server process. The delFile() function in common.file.func.php performs the actual deletion without canonicalizing the path or checking if it remains within the intended data/cache/review/ directory. Remediation requires casting itype and vid to integers and validating the final path with realpath() to ensure it stays within the intended directory.
Affected products
- SeaCMS SeaCMS up to 13.6
Timeline
- 2026-08-31: disclosed
- other: CVE-2026-82603 assigned; exploit is public