The vulnerability CVE-2025-68002 in 100plugins Open User Map arises from improper limitation of a pathname to a restricted directory, enabling path traversal attacks. This allows an attacker with network access and low privileges to read sensitive files outside the intended directory scope. The affected versions include all releases up to and including 1.4.16. The CVSS vector indicates no user interaction is required, and the impact is limited to confidentiality without affecting integrity or availability.

An attacker with low privileges can exploit this vulnerability to read arbitrary files on the system where Open User Map is installed, potentially exposing sensitive information. There is no indication of impact on data integrity or system availability. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected application and monitor for suspicious activity related to file access attempts. Avoid exposing the vulnerable versions publicly.