CVE-2025-60449: Infoleak

Published Oct 3, 2025

Updated

An information disclosure vulnerability has been discovered in SeaCMS 13.1. The vulnerability exists in the adminsafe.php component located in the /btcoan/ directory. This security flaw allows authenticated administrators to scan and download not only the application’s source code but also potentially any file accessible on the server’s root directory.

Affected Software

2 affected components

SEACMS SEACMS

SEACMS SEACMS=13.1

Event History

Oct 3, 2025

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·02:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-60449?

CVE-2025-60449 is classified as an information disclosure vulnerability that can expose sensitive application data.

How do I fix CVE-2025-60449?

To fix CVE-2025-60449, update SeaCMS to the latest version or apply any patches provided by the vendor.

Who is affected by CVE-2025-60449?

CVE-2025-60449 affects users running SeaCMS version 13.1.

What components are involved in CVE-2025-60449?

The vulnerability is located in the admin_safe.php component within the /btcoan/ directory of SeaCMS.

What can attackers do with CVE-2025-60449?

Attackers with authenticated access can exploit CVE-2025-60449 to scan and download the application's source code and potentially sensitive information.