The vulnerability identified as CVE-2025-27274 affects the axelkeller GPX Viewer up to version 2.2.11. It is a path traversal issue caused by improper handling of the '.../...//' sequence, which can be used to access files outside the intended directory structure. The CVSS vector indicates the attack requires network access, low attack complexity, and high privileges, with no user interaction needed. The impact is limited to confidentiality, with no integrity or availability impact reported.

An attacker with high privileges can exploit this vulnerability to read sensitive files outside the intended directories, potentially exposing confidential information. There is no indication of impact on data integrity or availability. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should restrict access to the GPX Viewer application to trusted users with appropriate privileges and monitor for any unusual file access patterns related to path traversal attempts.