CVE-2026-82598: SeaCMS Template Engine RCE Vulnerability

CVE-2026-82598 Overview

CVE-2026-82598 is a code injection vulnerability affecting SeaCMS versions up to 13.6. The flaw resides in the parseIf function within search.php, part of the Template Engine component. Attackers can manipulate the searchtype argument to inject arbitrary code through the template parser. The attack requires no authentication and can be executed remotely over the network. The exploit details have been publicly disclosed, increasing the likelihood of opportunistic exploitation against exposed SeaCMS deployments. The vulnerability is classified under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component.

Critical Impact
Unauthenticated remote attackers can inject code through the SeaCMS search template parser, compromising confidentiality, integrity, and availability of affected instances.

Affected Products

SeaCMS versions up to and including 13.6
SeaCMS Template Engine component (search.php)
The parseIf template parsing function

Discovery Timeline

2026-08-31 - CVE-2026-82598 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-82598

Vulnerability Analysis

The vulnerability exists in SeaCMS, a PHP-based content management system used primarily for video streaming websites. The parseIf function in search.php processes template directives without adequately neutralizing special characters received from user input. When the searchtype parameter is passed into the template engine, injected payloads are interpreted as executable template logic rather than data. This behavior allows an attacker to escape the intended template context and cause the PHP interpreter to evaluate attacker-controlled expressions. The public disclosure of the technique lowers the barrier for reproduction, and the network-facing nature of SeaCMS search functionality exposes affected sites to internet-based scans.

Root Cause

The root cause is improper neutralization of special elements in output used by a downstream component [CWE-74]. The parseIf function concatenates the searchtype value directly into template control structures without applying context-aware sanitization or a strict allow-list. Because SeaCMS template directives are ultimately compiled into PHP, the missing validation collapses the boundary between template data and template code.

Attack Vector

Exploitation occurs over the network by issuing an HTTP request to the SeaCMS search endpoint with a crafted searchtype parameter. No authentication or user interaction is required. A remote attacker can automate discovery and exploitation against exposed SeaCMS 13.6 or earlier instances. The publicly available proof-of-concept in the T-Chachamaru security advisory repository documents the exact request structure required to trigger the injection.

No verified exploitation code is reproduced here. Refer to the linked advisory for reproduction details.

Detection Methods for CVE-2026-82598

Indicators of Compromise

HTTP requests to search.php containing unusual characters in the searchtype parameter, including template delimiters, backticks, or PHP function names.
Unexpected PHP processes spawned by the web server user immediately after search requests.
New or modified files in SeaCMS template and cache directories that do not match a known deployment.
Outbound network connections initiated by the web server to unfamiliar hosts following search activity.

Detection Strategies

Deploy web application firewall rules that inspect the searchtype query parameter for template metacharacters and reject anomalous payloads.
Enable verbose access logging on the SeaCMS front end and alert on repeated 200-status requests to search.php with abnormally long or encoded parameters.
Correlate web server access logs with process creation telemetry on the host to identify command execution triggered by search requests.

Monitoring Recommendations

Monitor file integrity across the SeaCMS installation directory, prioritizing search.php, template files, and the runtime cache.
Track egress traffic from web server hosts and alert on connections to non-approved destinations.
Review scheduled tasks, PHP session files, and web shells periodically for signs of post-exploitation persistence.

How to Mitigate CVE-2026-82598

Immediate Actions Required

Restrict public access to the SeaCMS search endpoint using network controls or authentication requirements until a vendor patch is applied.
Deploy virtual patching through a web application firewall to block requests containing template injection patterns in the searchtype parameter.
Audit the affected host for signs of prior exploitation, including web shells and unauthorized administrative accounts.

Patch Information

At the time of publication, no fixed version has been listed in the enriched CVE data. Administrators should monitor the SeaCMS project channels and the GitHub security advisory for updates. Additional tracking is available on the VulDB CVE record.

Workarounds

Apply an allow-list on the searchtype parameter at the reverse proxy or WAF layer, permitting only expected alphanumeric values.
Disable or remove the SeaCMS search feature if it is not required for the deployment.
Run the web server process with least privilege and disable dangerous PHP functions such as system, exec, passthru, and shell_exec via disable_functions in php.ini.

bash

# Example php.ini hardening
disable_functions = system,exec,passthru,shell_exec,popen,proc_open,eval