CVE-2026-85137
Received Received - Intake

Code Injection in SeaCMS via Locoy Collector

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: VulDB

Description
A security vulnerability has been detected in SeaCMS up to 13.6. This impacts the function parseIf of the file seacms_locoy_news.php of the component Locoy Collector. The manipulation of the argument pwd leads to code injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-85137
EUVD
EUVD-2026-70519

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
seacms seacms to 13.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-85137 is a code injection vulnerability in SeaCMS versions up to 13.6. It affects the Locoy Collector module's parseIf function in seacms_locoy_news.php. The flaw allows remote attackers to inject malicious code via the pwd parameter, leading to remote code execution (RCE) on the server. Exploitation requires no authentication and can be performed remotely.

Detection Guidance

Check if SeaCMS 13.6 with the Locoy Collector module is installed. Look for the hard-coded default password '123456' in seacms_locoy_news.php. Test by sending a POST request with the default password and template injection payload to the collector endpoint.

Impact Analysis

This vulnerability allows unauthenticated attackers to execute arbitrary commands on the server hosting SeaCMS. They could take full control of the system, steal data, install malware, or disrupt services. The impact includes complete server compromise and potential lateral movement within a network.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and security. GDPR requires adequate security measures to protect personal data, and HIPAA mandates safeguards for protected health information. A successful exploit could lead to data breaches, resulting in regulatory fines and legal consequences.

Mitigation Strategies

Remove the hard-coded default password. Disable the Locoy Collector module if unused. Enforce strong authentication for collector endpoints. Strip executable template syntax from imported content. Replace PHP eval() in the parser with safer alternatives.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85137. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart