The SeaCMS Template Engine contains a flaw in the parseIf function within search.php where manipulating the searchtype argument allows an attacker to inject arbitrary code. Because the input is not properly neutralized, the underlying PHP code can be altered, resulting in remote code execution. This vulnerability is a classic example of code injection (CWE‑94) and improper neutralization of special elements (CWE‑74). The potential impact includes full system compromise, data theft, and malicious code deployment.

SeaCMS software up to version 13.6 is affected. The vulnerability resides in the search.php component of the template engine, and any instance of SeaCMS running a version equal to or older than 13.6 may be vulnerable. No later version has yet been confirmed to be vulnerable, and the vendor has not released a patch at the time of this advisory.

The CVSS score of 6.9 indicates a moderate risk. The EPSS score is not available, but the vulnerability is publicly disclosed and can be exploited remotely via the searchtype parameter. It is not listed in the CISA KEV catalog, but its code‑injection nature means that once exploited, an attacker can execute arbitrary commands on the host. Organizations should treat this as a significant threat if they are running vulnerable versions of SeaCMS.