CVE-2026-82599: SeaCMS Path Traversal Vulnerability

CVE-2026-82599 Overview

CVE-2026-82599 is a path traversal vulnerability [CWE-22] affecting SeaCMS versions up to 13.6. The flaw resides in the unlink function invoked by /member.php?action=chgpwdsubmit within the Avatar Upload component. An authenticated attacker can manipulate the oldpic argument to traverse the file system and delete arbitrary files outside the intended avatar directory. The vulnerability is exploitable remotely over the network and requires only low-privilege user credentials. A public exploit has been referenced in a GitHub security advisory, increasing the likelihood of opportunistic abuse against exposed SeaCMS deployments.

Critical Impact
Authenticated remote attackers can delete arbitrary files on the SeaCMS server, potentially disrupting site availability and enabling follow-on attacks.

Affected Products

SeaCMS versions up to and including 13.6
Avatar Upload component within /member.php?action=chgpwdsubmit
Deployments exposing member registration and profile management endpoints

Discovery Timeline

2026-08-31 - CVE-2026-82599 published to the National Vulnerability Database (NVD)
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-82599

Vulnerability Analysis

The vulnerability affects SeaCMS, a PHP-based content management system used for video portals. The chgpwdsubmit action in member.php handles avatar-related operations during password change submission. When a user submits the form, the application passes the oldpic parameter to PHP's unlink function without sanitizing directory separators or resolving path traversal sequences such as ../. An authenticated member can therefore supply a crafted oldpic value that references files outside the avatar upload directory.

Successful exploitation results in the deletion of arbitrary files that the PHP process can access. Attackers may delete configuration files, cached templates, session stores, or installation lock files to disrupt service or force the application into a re-installation state that can be leveraged for further compromise.

Root Cause

The root cause is missing input validation on the oldpic argument before it is passed to a file system deletion primitive. The application trusts client-supplied file paths and does not enforce a canonical base directory check or reject traversal sequences. This is a classic instance of CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Attack Vector

Exploitation requires an authenticated SeaCMS member account, which can typically be obtained through self-registration on affected sites. The attacker submits a POST request to /member.php?action=chgpwdsubmit with the oldpic parameter set to a traversal payload such as ../../data/config.php. The vulnerable code path invokes unlink on the resolved path, deleting the target file if the web server user has sufficient permissions.

Refer to the GitHub Security Advisory for Seacms and the VulDB CVE-2026-82599 Details for the full technical write-up.

Detection Methods for CVE-2026-82599

Indicators of Compromise

POST requests to /member.php?action=chgpwdsubmit containing ../ or URL-encoded traversal sequences (%2e%2e%2f) in the oldpic parameter
Unexpected deletion of PHP configuration files, template caches, or installation lock files under the SeaCMS document root
Web server error logs referencing missing files that were previously present in core SeaCMS directories

Detection Strategies

Inspect web server and application access logs for chgpwdsubmit requests where oldpic contains directory separators or parent-directory references
Deploy Web Application Firewall (WAF) rules that block traversal patterns in the oldpic parameter for the member endpoint
Enable file integrity monitoring on the SeaCMS installation directory to detect unauthorized deletions

Monitoring Recommendations

Alert on repeated authenticated requests to member.php from a single account within short time windows
Monitor for sudden creation of new low-privilege member accounts followed by profile modification activity
Correlate file deletion events on the web server with authenticated session identifiers in application logs

How to Mitigate CVE-2026-82599

Immediate Actions Required

Restrict public access to /member.php or disable self-registration until a patched build is available
Audit the SeaCMS installation directory for missing or unexpectedly modified files
Revoke and re-issue member session tokens if suspicious activity is observed
Ensure the web server user has the minimum file system privileges required for normal operation

Patch Information

No official vendor patch reference is included in the enriched CVE data at time of publication. Review the GitHub Security Advisory for Seacms and monitor the SeaCMS project for an updated release beyond version 13.6 that validates the oldpic parameter.

Workarounds

Apply a WAF signature that rejects requests to /member.php?action=chgpwdsubmit whose oldpic value contains .., /, \, or their URL-encoded equivalents
Modify the affected handler to enforce a canonical base directory check using realpath() before calling unlink
Set restrictive file system permissions so that critical configuration files cannot be removed by the PHP process user
Temporarily disable the avatar change functionality by removing or gating the chgpwdsubmit action

bash

# Example ModSecurity rule to block traversal in oldpic parameter
SecRule REQUEST_URI "@contains /member.php" \
  "chain,phase:2,deny,status:403,id:1026082599,\
   msg:'CVE-2026-82599 SeaCMS oldpic path traversal attempt'"
  SecRule ARGS:oldpic "@rx (\.\./|\.\.\\|%2e%2e%2f|%2e%2e/)" "t:none,t:lowercase,t:urlDecodeUni"