CVE-2026-82603: SeaCMS Path Traversal Vulnerability

CVE-2026-82603 Overview

CVE-2026-82603 is a path traversal vulnerability [CWE-22] affecting SeaCMS versions up to 13.6. The flaw resides in the /member.php?action=del_pl endpoint of the Comment Cache component. Attackers can manipulate the itype or vid arguments to traverse directories and delete files outside the intended scope. The vulnerability is exploitable remotely with low-privileged authentication and requires no user interaction. A public exploit has been disclosed, increasing the risk of opportunistic attacks against exposed installations.

Critical Impact
Authenticated remote attackers can delete arbitrary JavaScript files on the server by supplying crafted itype or vid parameters, potentially disrupting site functionality.

Affected Products

SeaCMS versions up to and including 13.6
Component: Comment Cache (/member.php?action=del_pl)
Vulnerable parameters: itype, vid

Discovery Timeline

2026-08-31 - CVE-2026-82603 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-82603

Vulnerability Analysis

The vulnerability is a classic path traversal issue [CWE-22] in the SeaCMS Comment Cache handler. When a user triggers the del_pl action in member.php, the application accepts user-supplied itype and vid parameters and uses them to construct a file path for deletion. Because the input is not properly sanitized or normalized, an attacker can inject traversal sequences such as ../ to escape the intended cache directory. This enables deletion of files elsewhere on the server file system. The public disclosure of the exploit lowers the barrier for reproduction and abuse.

Root Cause

The root cause is missing input validation on the itype and vid parameters before they are concatenated into a file path passed to a file deletion routine. The code path does not enforce a canonical base directory nor reject relative path segments. Any authenticated user with access to member.php can leverage this weakness.

Attack Vector

The attack is executed over the network against the SeaCMS web interface. A low-privileged authenticated user submits a crafted request to /member.php?action=del_pl with traversal payloads embedded in itype or vid. The server resolves the manipulated path and deletes the target file. According to the referenced GitHub Security Advisory, the demonstrated impact is deletion of JavaScript files, which can break site functionality and enable follow-on attacks.

No verified exploit code is reproduced here. Refer to the VulDB entry and the linked advisory for technical proof-of-concept details.

Detection Methods for CVE-2026-82603

Indicators of Compromise

HTTP requests to /member.php?action=del_pl containing traversal sequences such as ../ or URL-encoded equivalents (%2e%2e%2f) in the itype or vid parameters.
Unexpected deletion of .js files or other static assets under the SeaCMS web root.
Web server access logs showing authenticated del_pl calls originating from unusual user agents or IP addresses.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect query strings for path traversal patterns targeting member.php.
Enable file integrity monitoring on the SeaCMS web root to alert on unauthorized file deletions.
Correlate authentication logs with del_pl requests to identify accounts abusing the endpoint.

Monitoring Recommendations

Forward SeaCMS access logs and file system audit events to a centralized SIEM for correlation.
Alert on repeated 200-status del_pl requests from a single session within a short window.
Track baseline file counts and hashes for the js/ and cache directories to detect tampering.

How to Mitigate CVE-2026-82603

Immediate Actions Required

Restrict access to /member.php behind IP allowlists or authenticated proxy controls where feasible.
Audit SeaCMS user accounts and remove or reset any accounts that are not actively required.
Back up the SeaCMS installation and static assets so deleted files can be restored quickly.

Patch Information

At the time of publication, no vendor-supplied patch is referenced in the NVD entry. Monitor the SeaCMS security advisory repository and vendor channels for an official fix. Once a patched release is available, upgrade all instances of SeaCMS running version 13.6 or earlier.

Workarounds

Apply WAF signatures that block path traversal payloads on the itype and vid parameters of /member.php?action=del_pl.
Enforce filesystem permissions so the web server process cannot delete files outside the designated cache directory.
Temporarily disable the comment cache deletion feature if it is not required in the deployment.

bash

# Example WAF rule (ModSecurity) blocking traversal on del_pl parameters
SecRule REQUEST_URI "@contains /member.php" "chain,id:1008260,phase:2,deny,status:403,msg:'CVE-2026-82603 SeaCMS del_pl path traversal'"
  SecRule ARGS:itype|ARGS:vid "@rx (\.\./|%2e%2e%2f|\.\.\\)" "t:none,t:urlDecodeUni"