# CVE-2026-85137: SeaCMS Locoy Collector code injection via default password

Source: https://junglewise.ai/threats/cve-2026-85137-seacms-locoy-collector-code-injection-via-default-password  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-85137 · Severity: high · CVSS 7.3 · Published 2026-09-03

SeaCMS includes an optional article collector module with a hardcoded default password (123456). An unauthenticated attacker who knows this password can inject malicious template code into articles, which is later executed as PHP code when articles are rendered on the front end. This allows remote code execution on the web server.

Technologies: [Seacms](https://junglewise.ai/threats/technologies/seacms). Vendors: [Seacms](https://junglewise.ai/threats/vendors/seacms).

## Quick answers

**Is CVE-2026-85137 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85137 being exploited in the wild.

**How severe is CVE-2026-85137?** High severity, with a CVSS score of 7.3, published 3 September 2026.

**Which products and versions are affected?** Seacms up to 13.6.

**Is there a fix for CVE-2026-85137?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-85137 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-85137?** Check whether you run Seacms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability combines a hardcoded default credential (CWE-798) with server-side template injection (CWE-94) and code injection. The seacms_locoy_news.php file in the optional Locoy Collector module checks for a hardcoded password ('123456') via the 'pwd' parameter but does not validate or strip executable template syntax from injected content. Article content containing {if:...} template directives is later evaluated by the parseIf() function using PHP eval(), allowing arbitrary code execution. The attack requires network access and knowledge of the default password, but no prior authentication or user interaction. The vulnerability is exploitable when the optional module is deployed to the admin directory as documented.

## Affected products

- SeaCMS SeaCMS up to 13.6

## Timeline

- 2026-09-03: disclosed
- exploited: Proof of concept exploit disclosed publicly

## References

- [https://github.com/T-Chachamaru/seacms-13.6-security-advisories/blob/a084a3e573240d54860153321df271280daec262/d-001-locoy-default-password-template-rce.md](https://github.com/T-Chachamaru/seacms-13.6-security-advisories/blob/a084a3e573240d54860153321df271280daec262/d-001-locoy-default-password-template-rce.md)
- [https://vuldb.com/cve/CVE-2026-85137](https://vuldb.com/cve/CVE-2026-85137)

## Related threats

- [SeaCMS SQL injection in comment API](https://junglewise.ai/threats/cve-2019-25778-seacms-through-8-7-contains-an-unauthenticated-sql-injection)
- [SeaCMS authenticated remote code execution in admin_config.php](https://junglewise.ai/threats/cve-2026-79423-seacms-authenticated-remote-code-execution-in-admin-config-php)
- [SeaCMS WeChat Module SQL injection via XML entity decoding](https://junglewise.ai/threats/cve-2026-85138-seacms-wechat-module-sql-injection-via-xml-entity-decoding)
- [SeaCMS path traversal in member.php comment deletion](https://junglewise.ai/threats/cve-2026-82603-seacms-path-traversal-in-member-php-comment-deletion)
- [SeaCMS authorization bypass in ass.php](https://junglewise.ai/threats/cve-2026-82602-seacms-authorization-bypass-in-ass-php)