SeaCMS CVE-2026-82603

Exploitation requires a valid member-level account on the target SeaCMS instance (PR:L per CVSS 4.0 vector), meaning member self-registration must be enabled or the attacker must have obtained credentials through other means. The attack specifically targets the Comment Cache deletion feature at /member.php?action=del_pl and requires manipulation of the itype and/or vid request parameters with path traversal sequences. No user interaction beyond the attacker's own crafted request is needed (UI:N). Exploitation is bounded by the member authentication requirement - unauthenticated access to this endpoint is not sufficient, limiting fully automated mass exploitation. Impact is restricted to file deletion (low integrity and low availability impact on the vulnerable system); no confidentiality impact is indicated by the VC:N metric.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L) yields a score of 5.3 (Medium), reflecting network-accessible exploitation, low complexity, no confidentiality impact, and limited integrity and availability impact. The PR:L metric is a meaningful risk limiter - exploitation requires a valid registered member account, constraining automated mass scanning or unauthenticated drive-by attacks. No EPSS score was provided in the input data, so exploitation probability cannot be independently quantified. No CISA KEV listing has been identified, meaning active widespread exploitation is not confirmed. However, the publicly available POC on GitHub is a material escalation factor: the E:P modifier in the CVSS 4.0 vector acknowledges this. The net assessment is a genuine but bounded priority - organizations with public member registration enabled on SeaCMS 13.6 face real risk of file deletion by any registered user, while those with tightly controlled member accounts are substantially less exposed.

An attacker registers a member account on a publicly accessible SeaCMS 13.6 site, then sends a crafted HTTP GET or POST request to /member.php?action=del_pl with traversal sequences embedded in the itype or vid parameter - for example, vid=../../assets/main.js - causing the application to delete a targeted file outside the cache directory such as a front-end JavaScript asset or configuration include. A public proof-of-concept detailing this technique is available on GitHub, making reproduction straightforward for low-skilled attackers.