CVE-2025-25800 describes an arbitrary file read vulnerability in SeaCMS 13.3, specifically in the file_get_contents function within admin_safe_file.php. This vulnerability allows remote attackers to read arbitrary files on the affected system without authentication. The weakness is a path traversal issue (CWE-22). The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low attack complexity, no privileges, and no user interaction required, impacting confidentiality only. There is no vendor advisory or patch information available at this time.

An attacker can remotely read arbitrary files on the server running SeaCMS 13.3, potentially exposing sensitive data such as configuration files, credentials, or other protected information. The vulnerability does not impact integrity or availability according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the admin_safe_file.php script and implement web application firewall (WAF) rules to detect and block path traversal attempts targeting this endpoint.