CVE-2026-85137 Details
Description
A security vulnerability has been detected in SeaCMS up to 13.6. This impacts the function parseIf of the file seacms_locoy_news.php of the component Locoy Collector. The manipulation of the argument pwd leads to code injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
A code injection vulnerability allowing remote code execution has been identified in SeaCMS versions prior to 13.6. This issue arises in the Locoy Collector component, specifically within the 'seacms_locoy_news.php' file. The vulnerability is triggered by manipulating the 'pwd' argument, exploiting a hard-coded default password. When the default password is used, an attacker can inject content containing SeaCMS template syntax, which is later processed by the application and executed as PHP code on the server.
Remove hard-coded default passwords, require authenticated administrative sessions or strong per-site API tokens for collector endpoints, strip or encode executable template syntax from imported content, remove PHP 'eval()' from the 'parseIf()' function, and avoid shipping optional web interfaces with default credentials.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 3, 2026CISA-ADP
Assessed Sep 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/T-Chachamaru/seacms-13.6-security-advisories/blob/a084a3e573240d54860153321df271280daec262/d-001-locoy-default-password-template-rce.md | [email protected] | ExploitRemedyTechnical Analysis |
| https://vuldb.com/cve/CVE-2026-85137 | [email protected] | Permission Required |
| https://vuldb.com/submit/892792 | [email protected] | Permission Required |
| https://vuldb.com/vuln/398364 | [email protected] | Permission Required |
| https://vuldb.com/vuln/398364/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SeaCMS | 13.6 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 5, 2026 | CVE Modified | CISA-ADP |
| Sep 3, 2026 | New CVE Received | [email protected] |