SeaCMS CVE-2026-82598

No authentication is required; the vulnerable searchtype parameter is reachable through SeaCMS's public-facing search interface, which is enabled by default. Exploitation requires that the cascade template engine feature be active - per the PoC advisory, this is the default SeaCMS configuration for version 13.6. No special network position, prior foothold, existing session, or user interaction is required. Exploitation is bounded to SeaCMS instances running version 13.6 or earlier on PHP-capable web servers; instances not publicly exposed or behind a WAF that filters the parameter are at reduced risk.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms unauthenticated, low-complexity remote exploitation requiring no user interaction - a worst-case access scenario. However, the impact metrics (VC:L/VI:L/VA:L) suggest a limited blast radius, likely because exploitation is constrained to the template engine execution context rather than direct OS-level command execution. A notable tension exists between the 'RCE' tag and the GitHub PoC title ('cascade-template-rce') on one hand, and the low-impact CVSS metrics on the other; this discrepancy is unresolved by any vendor statement and warrants hands-on testing to determine actual execution scope and privilege level. The E:P threat modifier confirms a public PoC exists, elevating practical risk beyond what the 5.5 CVSS-BT score alone conveys. No CISA KEV listing is present and no EPSS data was provided, so mass-exploitation probability is currently inferred from the unauthenticated network vector and public PoC availability rather than confirmed telemetry. The absence of any vendor patch for a publicly exploitable unauthenticated injection point should be treated as elevated risk for all internet-exposed SeaCMS deployments.

An unauthenticated attacker sends a crafted HTTP request to the publicly accessible SeaCMS search endpoint, injecting a PHP code payload via the searchtype parameter. The parseIf function in search.php processes this input within the cascade template engine without sanitization, causing the injected payload to be evaluated as PHP code. A public proof-of-concept exists for this exact path, as documented in the GitHub security advisory.