Description

A vulnerability was identified in SeaCMS up to 13.6. Affected by this vulnerability is the function unlink of the file /member.php?action=chgpwdsubmit of the component Avatar Upload. Such manipulation of the argument oldpic leads to path traversal. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-31T01:16:50.630Z",
  "pubdate": "2026-08-31T01:16:50.630Z",
  "executiveSummary": "A critical path traversal vulnerability exists in SeaCMS up to version 13.6, specifically within the Avatar Upload functionality of the /member.php?action=chgpwdsubmit endpoint.\nThis vulnerability is classified as an improper neutralization of special elements used in a pathname (Path Traversal), allowing an unauthenticated or authenticated attacker to perform unauthorized file system operations.\nThe root cause stems from insufficient validation of user-supplied input provided via the 'oldpic' argument, which is directly passed to the 'unlink' function.\nSuccessful exploitation enables remote attackers to delete arbitrary files on the underlying web server, potentially leading to a denial-of-service (DoS) condition or the removal of critical configuration and application files.\nThe vulnerability is accessible remotely, and exploit code is publicly available, significantly increasing the risk of exploitation by malicious actors.\nOrganizations using SeaCMS versions up to 13.6 are at risk and should prioritize immediate mitigation to prevent unauthorized file manipulation.",
  "technicalDetails": "The vulnerability resides in the avatar management mechanism of SeaCMS, specifically in the component responsible for processing profile updates. The core issue is an insecure implementation of file system interaction within /member.php, triggered when the 'action' parameter is set to 'chgpwdsubmit'.\nDuring the avatar update process, the application allows users to specify an 'oldpic' parameter, intended to facilitate the deletion of a previous avatar image from the server's storage directory before replacing it with a new file. However, the application fails to perform adequate sanitization or boundary checks on the 'oldpic' argument before passing it to the PHP 'unlink' function.\nBecause the 'oldpic' variable is concatenated directly into the file path string without stripping directory traversal sequences such as '../', an attacker can manipulate the input to escape the intended upload directory. By injecting relative path sequences into the 'oldpic' argument, an attacker can coerce the application into attempting to delete files located in sensitive directories outside the avatar storage path.\nThe attack flow proceeds as follows: First, the attacker identifies a target file path on the server that they wish to delete. Second, the attacker crafts an HTTP request to /member.php?action=chgpwdsubmit, setting the 'oldpic' parameter to a malicious payload designed to traverse the directory structure (e.g., ../../../path/to/target_file). Third, the web server executes the 'unlink' system call on the resolved path. Finally, if the web server process possesses sufficient permissions, the targeted file is permanently deleted from the file system.\nThis vulnerability is highly severe because it does not require complex binary exploitation. The dependency on the 'unlink' function means the primary impact is the unauthorized deletion of files. If the application runs with elevated privileges, an attacker might delete critical system files, configuration files (such as database connection strings), or application source code, resulting in total service disruption or potential secondary exploitation vectors. The exploit is currently public, providing a functional blueprint for attackers to target vulnerable SeaCMS deployments remotely."
}