Executive brief
SeaCMS is a content management system used to publish and manage media content on websites. An authenticated user can exploit a path traversal vulnerability in the comment deletion feature to delete arbitrary JavaScript files on the server, potentially disrupting site functionality or enabling attacks that compromise the website's integrity.
Technical details
The vulnerability is a path traversal / arbitrary file deletion flaw (CWE-22, CWE-73) in SeaCMS 13.6's member.php file at the action=del_pl endpoint. The itype and vid request parameters are concatenated directly into a file path without normalization or boundary validation, allowing a low-privileged authenticated member to traverse directories (e.g., via ../../../uploads/) and delete .js files outside the intended cache directory. An attacker constructs a malicious request with path traversal sequences in the itype/vid parameters to delete arbitrary files writable by the web server process. The delFile() function in common.file.func.php performs the actual deletion without canonicalizing the path or checking if it remains within the intended data/cache/review/ directory. Remediation requires casting itype and vid to integers and validating the final path with realpath() to ensure it stays within the intended directory.
Affected products
- SeaCMS SeaCMS up to 13.6
Timeline
- 2026-08-31: disclosed
- other: CVE-2026-82603 assigned; exploit is public