The Nomupay Payment Processing Gateway contains a Path Traversal vulnerability (CVE-2025-46486) due to improper restriction of pathname access. This allows an attacker with high privileges to access files outside of restricted directories, potentially exposing sensitive information. The vulnerability affects versions up to 7.1.7. The CVSS 3.1 base score is 4.9 (medium), reflecting network attack vector, low attack complexity, required high privileges, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. No patch or vendor advisory is currently provided.

An attacker with high privileges could exploit this vulnerability to read sensitive files outside of intended directories, leading to confidentiality breaches. There is no impact on system integrity or availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict high privilege access to trusted users only and monitor for suspicious activity related to file access. Avoid exposing the affected software to untrusted networks or users with elevated privileges.