The vulnerability identified as CVE-2025-32209 affects the totalprocessing Nomupay Payment Processing Gateway up to version 7.1.5. It is caused by improper limitation of pathnames to restricted directories, enabling path traversal attacks. An attacker with network access and low privileges can exploit this issue without user interaction to read sensitive files outside the intended directory scope. The CVSS vector indicates high confidentiality impact but no impact on integrity or availability.

Successful exploitation could lead to unauthorized disclosure of sensitive files on the affected system, potentially exposing confidential information. There is no indication of integrity or availability impact. No known exploits are reported in the wild as of the publication date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. In the meantime, restrict network access to the affected service and review access controls to minimize exposure.