CVE-2025-27920 Srimax Output Messenger Directory Traversal
Attackers can access sensitive files outside the intended directory via directory traversal, leading to configuration leakage or arbitrary file access.
- Exploited in the wild
- Since 19 May 2025
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-27920?
CVE-2025-27920 is a high-severity path traversal vulnerability in Srimax Output Messenger, published on 5 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Output Messenger before 2.0.63 was vulnerable to a directory traversal attack through improper file path handling. By using ../ sequences in parameters, attackers could access sensitive files outside the intended directory, potentially leading to configuration leakage or arbitrary file access.
Weakness: CWE-24
Which versions are affected by CVE-2025-27920?
It affects 1 product.
Products include Srimax Output Messenger.
How do I fix CVE-2025-27920?
No fix has been published for CVE-2025-27920 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 9 Jun 2025.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-27920 being exploited?
Yes. Attackers have exploited CVE-2025-27920 in the wild since at least 19 May 2025.
Other vulnerabilities in Srimax Output Messenger
Sources
Also known as GHSA-66q6-24vw-2g98.