CVE-2026-85137 in SeaCMS
Summary
by MITRE • 09/03/2026
A security vulnerability has been detected in SeaCMS up to 13.6. This impacts the function parseIf of the file seacms_locoy_news.php of the component Locoy Collector. The manipulation of the argument pwd leads to code injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/03/2026
The identified vulnerability resides within the SeaCMS content management system, specifically affecting versions up through 13.6 in the Locoy Collector component. This security flaw is located in the parseIf function found within the seacms_locoy_news.php file. The core technical issue stems from insufficient input validation and sanitization mechanisms when processing user-supplied data passed via the pwd argument. Because this parameter is not properly escaped or validated before being processed by the application logic, an attacker can inject arbitrary code into the execution stream. This type of flaw is classically categorized under CWE-94 as Improper Control of Generation of Code (Code Injection), where the software does not neutralize or incorrectly neutralizes user input that could influence the syntax or control flow of dynamically generated code.
The operational impact of this vulnerability is severe due to its remote exploitable nature. An attacker can initiate an attack from a distant location over a network, such as the internet, without requiring prior authentication in many configurations where the affected endpoint is publicly accessible. By manipulating the pwd parameter, the adversary achieves arbitrary code execution on the vulnerable server. This capability allows for complete compromise of the underlying system, enabling data theft, modification of website content, installation of backdoors, or use of the compromised host as a pivot point for further attacks within an internal network. The fact that public exploits have been disclosed significantly lowers the barrier to entry for malicious actors, increasing the likelihood of automated scanning and exploitation attempts against unpatched instances.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK technique T1059 Command and Scripting Interpreter, specifically involving server-side script interpretation such as PHP. The ability to inject code via web parameters is also consistent with CWE-79 Cross-site Scripting if the context allows for browser-based execution, but given it leads to direct code injection in a backend file processing function, it primarily represents a Remote Code Execution (RCE) vector often associated with CWE-502 Deserialization of Untrusted Data or CWE-611 Improper Restriction of XML External Entity Reference if the parsing logic involves XML structures, though here it is explicitly noted as code injection. The presence of public exploits indicates that automated tools are likely already probing for this specific signature in the wild.
Mitigation strategies must focus on immediate remediation and defensive hardening. The primary recommendation is to upgrade SeaCMS to a version newer than 13.6 where the parseIf function has been patched with proper input validation, output encoding, or strict type checking for the pwd argument. If upgrading is not immediately feasible, administrators should implement web application firewall rules that detect and block malicious payloads targeting the seacms_locoy_news.php endpoint, particularly looking for suspicious characters in the pwd parameter such as quotes, semicolons, or PHP function calls. Additionally, restricting access to administrative interfaces and collector components via IP whitelisting can reduce the attack surface. Regular security audits and code reviews focusing on input handling in legacy modules are essential to prevent similar vulnerabilities from persisting in older versions of content management systems.