SeaCMS CVE-2026-82599

Exploitation requires a valid low-privilege user account on the target SeaCMS installation (CVSS PR:L confirmed). The attack targets the specific endpoint /member.php?action=chgpwdsubmit and the oldpic POST parameter within the Avatar Upload component - no other application feature or configuration toggle is implicated. The web server process must have OS-level delete permissions on the traversal-targeted file; files owned by other OS users or protected by restrictive filesystem ACLs are not reachable. Exploitation is strictly limited to file deletion - there is no read or exfiltration capability from this vulnerability alone (VC:N confirmed by CVSS). Instances with open user registration face the highest practical risk since obtaining the required account requires no prior authorization. Closed/private deployments where user accounts are administrator-provisioned face substantially lower exposure. Network access to the HTTP(S) interface is required but no special network position (e.g., same-segment, VPN) is needed (AV:N).

The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L, score 2.1) scores low due to the combination of limited impact (no confidentiality exposure, only low-rated integrity and availability) and the PR:L authentication barrier. However, several signals elevate practical risk above the raw score: a public PoC is confirmed (E:P in the CVSS 4.0 supplemental metrics), meaning any registered user can reproduce the attack with minimal effort; and file deletion, while rated 'Low' impact individually, can trigger cascading failures if critical files such as database configuration, application bootstrap, or CMS session files are targeted. EPSS data is not provided in the available intelligence and cannot be independently inferred. KEV status is not confirmed - this is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis. The primary limiting factor is the PR:L requirement: attackers must hold a valid SeaCMS account. Open registration instances face materially higher exposure than closed/private deployments. Overall, this is a genuine but constrained risk - prioritize remediation in instances with open or broad user registration.

A registered SeaCMS user (obtained via open registration or a compromised account) submits a crafted POST request to /member.php?action=chgpwdsubmit, setting the oldpic parameter to a path-traversal string targeting a sensitive file, for example ../../config/database.php or ../../index.php. The server's unlink() call deletes the specified file without boundary validation, disrupting application function or destroying configuration data. The publicly available PoC on GitHub provides a ready-made demonstration of this technique, meaning any user with basic HTTP knowledge can replicate the attack against a vulnerable instance.