CVE-2026-79423

CVE-2026-79423 is an authenticated remote code execution flaw (CWE-78, OS command injection) in the admin_config.php component of SeaCMS version 13.6, a self-hosted PHP video/content management system. An attacker who holds valid admin-panel credentials (CVSS privileges required: low) can send a crafted POST request to admin_config.php to inject and execute arbitrary operating-system commands on the web server. Successful exploitation yields full code execution under the web service account, with high impact to confidentiality, integrity, and availability, and could allow follow-on actions such as defacement, data theft, or pivoting into the hosting environment. Only deployments running SeaCMS 13.6 (and potentially adjacent versions, which are not specified in the data) that expose the admin interface are affected. There is currently no known public proof-of-concept, the issue is not in CISA's KEV, and the EPSS score of ~0.5% (39th percentile) indicates a low estimated probability of exploitation in the next 30 days.

What to do: Audit and restrict access to admin_config.php (e.g., allow-list trusted admin IPs) and review web logs for suspicious POST requests to it from authenticated sessions. Upgrade SeaCMS to a patched release when the vendor publishes one beyond 13.6, and rotate admin credentials if any unauthorized administrator accounts or anomalous admin activity are found.