Vulnerability · Published Aug 31, 2026 · Assigned by VulDB
CVE-2026-82598SeaCMS Template search.php parseIf code injection
High 7.3
In plain English
A high-severity code injection in SeaCMS. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).
Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.5%top 55.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability was determined in SeaCMS up to 13.6. Affected is the function parseIf of the file search.php of the component Template Engine. This manipulation of the argument searchtype causes code injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
Affected products (as reported)
Weakness: CWE-94, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-397100 | SeaCMS Template search.php parseIf code injection vdb-entry, technical-description
- VDB-397100 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- CVE-2026-82598 | CVE Analysis and Report third-party-advisory
- Submit #892763 | SeaCMS 13.6 Code Injection third-party-advisory
- https://github.com/T-Chachamaru/seacms-13.6-security-advisories/blob/a084a3e573240d54860153321df271280daec262/c-009-search-cascade-template-rce.md exploit