CVE-2018-16821: Unrestricted Upload of File with Dangerous Type

SeaCMS 6.64 allows arbitrary directory listing via upload/admin/admintemplate.php?path=../templets/../../ requests...