Description

A vulnerability was determined in SeaCMS up to 13.6. Affected is the function parseIf of the file search.php of the component Template Engine. This manipulation of the argument searchtype causes code injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-31T01:16:50.417Z",
  "pubdate": "2026-08-31T01:16:50.417Z",
  "executiveSummary": "A critical code injection vulnerability exists within the SeaCMS template engine, specifically affecting versions up to 13.6.\nThe vulnerability resides in the parseIf function located within search.php.\nBy manipulating the searchtype argument, a remote, unauthenticated attacker can inject and execute arbitrary code on the underlying server.\nThis flaw poses a severe risk to system integrity and confidentiality, potentially allowing full system compromise.\nThe vulnerability is actively exploitable, with proof-of-concept exploits publicly available, increasing the risk of automated attacks.\nImmediate remediation or restricted access is recommended to prevent unauthorized remote execution.",
  "technicalDetails": "The vulnerability is classified as a code injection flaw within the SeaCMS template parsing mechanism. The root cause is identified as the improper sanitization and handling of user-supplied input passed to the parseIf function in search.php.\nSpecifically, the application fails to validate the searchtype argument before processing it within the template engine logic. This failure permits an attacker to inject malicious expressions or code fragments that the template engine subsequently evaluates as executable instructions.\nThe attack flow proceeds as follows: 1. An attacker crafts a malicious payload designed to interact with the server's backend processing logic, targeting the template parsing function. 2. The attacker transmits this payload via an HTTP request to the search.php file, passing the payload through the vulnerable searchtype parameter. 3. Upon receiving the request, the application passes the unsanitized input to the parseIf function. 4. The template engine, incorrectly assuming the input is safe, executes the injected code within the context of the web server process.\nBecause the vulnerability exists in a publicly accessible component and does not require authentication, the attack surface is exposed to any remote entity capable of reaching the web server. There are no privilege requirements, as the code executes with the permissions of the web server user (typically www-data or similar), providing the attacker with significant control over the environment.\nThe post-exploitation impact includes the potential for full system compromise, remote command execution (RCE), data exfiltration, or the deployment of persistent backdoors. The payload behavior is limited only by the privileges of the web application process, allowing an attacker to manipulate server files, access database credentials, or pivot deeper into the internal network infrastructure."
}