CVE-2026-82599

Name of the Vulnerable Software and Affected Versions SeaCMS versions prior to 13.7

Description A path traversal issue exists in the Avatar Upload component within the /member.php?action=chgpwdsubmit endpoint. The vulnerability occurs in the unlink() function when processing the oldpic variable, allowing a remote attacker to manipulate file paths.

Recommendations Update SeaCMS to a version later than 13.6. As a temporary mitigation, restrict access to the /member.php?action=chgpwdsubmit endpoint or avoid using the oldpic parameter.