A security vulnerability has been detected in SeaCMS up to 13.6. This impacts the function parseIf of the file seacms_locoy_news.php of the component Locoy Collector. The manipulation of the argument pwd leads to code injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

A code injection vulnerability has been identified in SeaCMS up to version 13.6, specifically within the parseIf function of the seacms_locoy_news.php file in the Locoy Collector component. The vulnerability is triggered by manipulating the 'pwd' argument, allowing an attacker to inject and execute arbitrary code. The attack can be initiated remotely without requiring physical access. A public exploit has already been disclosed, increasing the risk of active exploitation. This vulnerability poses a significant threat to systems running affected versions of SeaCMS. The issue has been assigned CVE-2026-85137 and is tracked across multiple vulnerability databases including NVD and VulDB. Administrators using SeaCMS up to 13.6 with the Locoy Collector component are advised to apply patches or mitigations immediately.