# CVE-2026-85138: SeaCMS WeChat Module SQL injection via XML entity decoding

Source: https://junglewise.ai/threats/cve-2026-85138-seacms-wechat-module-sql-injection-via-xml-entity-decoding  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-85138 · Severity: high · CVSS 7.3 · Published 2026-09-03

SeaCMS is a content management system with an optional WeChat messaging module. The module fails to verify WeChat message signatures and incorrectly processes XML input, allowing unauthenticated attackers to inject SQL commands through specially crafted XML messages. This can lead to unauthorized data disclosure from the application's database.

Technologies: [Seacms](https://junglewise.ai/threats/technologies/seacms). Vendors: [Seacms](https://junglewise.ai/threats/vendors/seacms).

## Quick answers

**Is CVE-2026-85138 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85138 being exploited in the wild.

**How severe is CVE-2026-85138?** High severity, with a CVSS score of 7.3, published 3 September 2026.

**Which products and versions are affected?** Seacms up to 13.6.

**Is there a fix for CVE-2026-85138?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-85138 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-85138?** Check whether you run Seacms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

SeaCMS 13.6's WeChat module (weixin/index.php) contains a SQL injection vulnerability arising from unsafe XML parsing combined with unvalidated SQL concatenation. The vulnerability exists because: (1) signature verification is only performed for the echostr endpoint parameter, allowing unauthenticated XML POST requests to reach message processing; (2) the code applies addslashes() to raw XML input and then parses it with simplexml_load_string(), which decodes XML entities such as ' back to single quotes, circumventing the escaping; (3) parsed values are directly concatenated into LIKE SQL queries without parameterization. An unauthenticated remote attacker can send crafted XML with encoded SQL injection payloads (e.g., ' OR '1' LIKE '1) in the Content field to exfiltrate data. The vulnerability is exploitable only when the WeChat module is explicitly enabled (disabled by default in SeaCMS 13.6). Public exploits are available.

## Affected products

- SeaCMS SeaCMS up to 13.6

## Timeline

- 2026-09-03: disclosed
- exploited: public exploit available

## References

- [https://github.com/T-Chachamaru/seacms-13.6-security-advisories/blob/a084a3e573240d54860153321df271280daec262/d-003-weixin-xml-entity-sqli.md](https://github.com/T-Chachamaru/seacms-13.6-security-advisories/blob/a084a3e573240d54860153321df271280daec262/d-003-weixin-xml-entity-sqli.md)
- [https://vuldb.com/cve/CVE-2026-85138](https://vuldb.com/cve/CVE-2026-85138)

## Related threats

- [SeaCMS SQL injection in comment API](https://junglewise.ai/threats/cve-2019-25778-seacms-through-8-7-contains-an-unauthenticated-sql-injection)
- [SeaCMS authenticated remote code execution in admin_config.php](https://junglewise.ai/threats/cve-2026-79423-seacms-authenticated-remote-code-execution-in-admin-config-php)
- [SeaCMS Locoy Collector code injection via default password](https://junglewise.ai/threats/cve-2026-85137-seacms-locoy-collector-code-injection-via-default-password)
- [SeaCMS path traversal in member.php comment deletion](https://junglewise.ai/threats/cve-2026-82603-seacms-path-traversal-in-member-php-comment-deletion)
- [SeaCMS authorization bypass in ass.php](https://junglewise.ai/threats/cve-2026-82602-seacms-authorization-bypass-in-ass-php)