CVE-2018-16446: Seamcms Seacms

High severity, CVSS 7.5. EPSS: 1.9% chance of exploitation in the next 30 days.

An issue was discovered in SeaCMS through 6.61. adm1n/admin_database.php allows remote attackers to delete arbitrary files via directory traversal sequences in the bakfiles parameter. This can allow the product to be reinstalled by deleting install_lock.txt.

Affected products

• Seamcms Seacms: up to and including 6.61

Published 2018-09-04. Last modified 2026-06-17.