CVE-2025-27920

Description

Output Messenger before 2.0.63 was vulnerable to a directory traversal attack through improper file path handling. By using ../ sequences in parameters, attackers could access sensitive files outside the intended directory, potentially leading to configuration leakage or arbitrary file access.

CVSS v3.1 Score

7.2

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

CISA Known Exploited Vulnerability

This vulnerability is actively exploited in the wild.

Added: May 19, 2025 Remediation due: Jun 9, 2025

Weakness Type (CWE)

CWE-24 CWE-24

Affected Products

Vendor	Product	Versions
srimax	output_messenger	< 2.0.63

References

Advisories & Patches

https://www.outputmessenger.com/cve-2025-27920/

Other References

https://www.srimax.com/products-2/output-messenger/ https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-27920 https://www.microsoft.com/en-us/security/blog/2025/05/12/marbled-dust-leverages-zero-day-in-output-messenger-for-regional-espionage/

Frequently Asked Questions

What is CVE-2025-27920? +

Output Messenger before 2.0.63 was vulnerable to a directory traversal attack through improper file path handling. By using ../ sequences in parameters, attackers could access sensitive files outside the intended directory, potentially leading to configuration leakage or arbitrary file access. It has a CVSS v3.1 base score of 7.2 (HIGH). This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild.

How severe is CVE-2025-27920? +

CVE-2025-27920 has a CVSS v3.1 score of 7.2 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2025-27920? +

CVE-2025-27920 affects products from srimax, specifically: output_messenger. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-27920? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-59342

esm.sh is a nobuild content delivery network(CDN) for modern web development. In 136 and earlier, a path-traversal flaw in the …

CVE-2026-49103

Webmin before 2.640 does not safely construct a filename for saving of an attachment within the mailboxes component. This occurs …

CVE-2025-61318 9.1

Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability. This vulnerability stems from the admin/template.php component and the admin/plugin.php component. …

CVE-2023-6699 9.1

The WP Compress – Image Optimizer [All-In-One] plugin for WordPress is vulnerable to Directory Traversal in all versions up to, …

CVE-2024-23657 8.8

Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. Nuxt Devtools is missing …

CVE-2025-54769 8.8

An authenticated, read-only user can upload a file and perform a directory traversal to have the uploaded file placed in …