Description

A vulnerability was detected in SeaCMS up to 13.6. This issue affects some unknown processing of the file /member.php?action=del_pl of the component Comment Cache. The manipulation of the argument itype/vid results in path traversal. The attack may be launched remotely. The exploit is now public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-31T02:17:03.190Z",
  "pubdate": "2026-08-31T02:17:03.190Z",
  "executiveSummary": "A critical path traversal vulnerability has been identified in SeaCMS versions up to 13.6, specifically within the Comment Cache component handled by the file /member.php?action=del_pl.\nThe vulnerability allows remote, unauthenticated attackers to manipulate input parameters to traverse the filesystem, potentially leading to unauthorized file deletion or interaction with sensitive system files.\nThis flaw exists due to improper sanitization of user-supplied input in the 'itype' and 'vid' arguments, which are processed during the deletion of cached comment data.\nSuccessful exploitation grants an attacker the ability to escape the intended directory scope, posing a significant risk to the integrity of the web application and the underlying server environment.\nGiven that the exploit is public, the risk of active exploitation is high, necessitating immediate defensive measures to prevent unauthorized filesystem access or malicious file manipulation.",
  "technicalDetails": "The vulnerability resides within the /member.php script of SeaCMS, specifically triggered when the 'action' parameter is set to 'del_pl'. This routine is intended to manage the deletion of cached comment files. The implementation fails to sufficiently validate or sanitize the 'itype' and 'vid' arguments before they are utilized in filesystem operations.\nThe root cause is an insecure implementation of input handling where user-controlled variables are concatenated into a file path string without stripping directory traversal sequences such as '../' (dot-dot-slash). By injecting these sequences into the 'itype' or 'vid' parameters, an attacker can manipulate the path resolution process to point to arbitrary locations on the host filesystem.\nThe attack flow initiates with an HTTP request to the /member.php endpoint. The attacker supplies a crafted payload within the 'itype' or 'vid' parameters containing directory traversal sequences. When the backend code processes the request to locate the target file for deletion, the server follows the path manipulation, effectively resolving a path outside of the designated comment cache directory.\nThis allows for the targeting of critical configuration files, session tokens, or other sensitive system artifacts depending on the permissions of the web service account. Because the application logic executes the deletion command based on these manipulated paths, the system inadvertently grants the attacker the ability to delete arbitrary files reachable by the web service user, leading to potential denial-of-service (DoS) or, in certain configurations, further exploitation vectors if specific file types are removed.\nThe vulnerability is remotely exploitable, requiring no prior authentication, and operates over the standard HTTP/HTTPS protocol. The scope of impact is limited by the privileges of the web application process; however, in standard shared hosting or improperly containerized environments, the ability to delete files across the filesystem can lead to catastrophic compromise of service availability and data integrity. As the exploit details are public, the barrier to entry for malicious actors is minimal."
}