CVE-2026-82601: SeaCMS 13.6 Cross-Site Scripting (XSS) Vulnerability

CVE-2026-82601 Overview

CVE-2026-82601 is a reflected Cross-Site Scripting (XSS) vulnerability affecting SeaCMS versions up to 13.6. The flaw resides in the /err.php file and stems from improper handling of the errtxt parameter. Attackers can inject arbitrary JavaScript that executes in a victim's browser when the crafted URL is visited. The issue is tracked under [CWE-79] and can be launched remotely across the network with no authentication required, though user interaction is needed. A public proof-of-concept is available through a GitHub security advisory.

Critical Impact
Successful exploitation enables session hijacking, credential theft, and unauthorized actions performed in the context of an authenticated SeaCMS user visiting a malicious link.

Affected Products

SeaCMS versions up to and including 13.6
The vulnerable component is the /err.php endpoint
The affected input is the errtxt request parameter

Discovery Timeline

2026-08-31 - CVE-2026-82601 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-82601

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in SeaCMS, a PHP-based content management system commonly used for video portals. The /err.php script accepts an errtxt parameter and reflects the value back into the HTML response without adequate output encoding or input sanitization. An attacker can craft a URL containing JavaScript payload data in errtxt and deliver it through phishing, forum posts, or malicious redirects. When a targeted user opens the link, the payload executes within the SeaCMS origin, granting the attacker access to cookies, session tokens, and any user-authorized actions.

Root Cause

The root cause is missing neutralization of user-supplied input during web page generation. The errtxt parameter is written into the response body without HTML entity encoding or context-aware escaping, allowing script tags and JavaScript event handlers to render as executable content in the browser.

Attack Vector

Exploitation occurs remotely over the network. The attacker crafts a malicious URL pointing at the target SeaCMS instance with a JavaScript payload embedded in the errtxt query string. The victim must click or otherwise load the URL. No authentication is required to prepare the payload, but the attack achieves highest impact when the victim holds an authenticated administrative session. Full technical details are available in the GitHub Security Advisory and the VulDB CVE Report.

A proof-of-concept payload is documented in the public advisory. Refer to the linked references for the exact request format; synthetic exploit code is not reproduced here.

Detection Methods for CVE-2026-82601

Indicators of Compromise

HTTP GET or POST requests to /err.php containing script tags, javascript: URIs, or common event-handler attributes such as onerror and onload within the errtxt parameter.
Encoded payload variants using URL, HTML entity, or Base64 encoding in the errtxt value to bypass naive filters.
Referer headers on /err.php requests originating from external domains, phishing lures, or shortened URLs.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the errtxt parameter for HTML tags, script content, and known XSS signatures.
Review web server access logs for anomalous query string lengths or non-ASCII sequences directed at /err.php.
Correlate suspicious /err.php traffic with subsequent authenticated session anomalies such as password changes or new admin activity.

Monitoring Recommendations

Enable Content Security Policy (CSP) violation reporting to surface unexpected inline script execution on SeaCMS pages.
Monitor browser-side error telemetry from admin users for script errors originating from err.php.
Alert on outbound connections from browser sessions to attacker-controlled hosts immediately following visits to /err.php.

How to Mitigate CVE-2026-82601

Immediate Actions Required

Restrict public access to the /err.php endpoint until a vendor-supplied patch is applied, using WAF rules or reverse proxy filtering.
Instruct SeaCMS administrators and editors to avoid clicking untrusted links to the CMS domain and to log out of admin sessions when not in active use.
Rotate administrative credentials and invalidate active sessions if suspicious /err.php traffic is detected in access logs.

Patch Information

No official vendor patch has been referenced in the NVD entry at the time of publication. Track the VulDB Vulnerability Overview and the GitHub Security Advisory for updates from the SeaCMS project. Upgrade to a fixed release as soon as it is published by the vendor.

Workarounds

Implement HTML entity encoding for the errtxt parameter in a local fork or via server-side output filtering before rendering.
Deploy a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Add a WAF signature to block requests to /err.php containing <, >, script, on*=, or javascript: sequences in the errtxt parameter.

bash

# Example nginx rule to block suspicious errtxt payloads
location = /err.php {
    if ($arg_errtxt ~* "(<|>|script|onerror|onload|javascript:)") {
        return 403;
    }
}