The vulnerability identified as CVE-2025-25162 involves improper limitation of a pathname to a restricted directory in the kutu62 Sports Rankings and Lists software. This flaw enables absolute path traversal, which can allow an attacker to access files outside the intended directory scope. The affected versions include all releases up to 1.0.2. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact with no impact on integrity or availability.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to read arbitrary files on the affected system, potentially exposing sensitive information. There is no indication of impact on system integrity or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected application and monitor for unusual file access patterns. Avoid exposing the vulnerable service to untrusted networks if possible.