CVE-2025-27920
Srimax Output Messenger ≤ 2.0.63
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:NSummary
CVE-2025-27920 is a high-severity Path Traversal: '../filedir' (CWE-24) vulnerability in Srimax Output Messenger. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked in the top 24% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
Output Messenger before version 2.0.63 is affected by a directory traversal vulnerability (CWE-24) stemming from improper file path handling that permits ../ sequences in parameters. This flaw enables access to files outside the intended directory and can result in configuration leakage or arbitrary file reads. The issue carries a CVSS 3.1 score of 7.2 with network attack vector, low complexity, and no authentication or user interaction required.
Remote unauthenticated attackers can exploit the weakness over the network to read sensitive files on affected installations, potentially exposing configuration data or other restricted content. The changed scope in the CVSS vector indicates the impact can extend beyond the vulnerable component itself.
The vendor advisory at outputmessenger.com/cve-2025-27920 and the product site recommend upgrading to version 2.0.63 or later. The vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active in-the-wild use.
Microsoft has attributed exploitation of the flaw as a zero-day to the Marbled Dust threat actor for regional espionage operations. The EPSS score reached a peak of 0.5202 with a current value of 0.5015.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-13464
Vulnerability Data
Output Messenger before 2.0.63 was vulnerable to a directory traversal attack through improper file path handling. By using ../ sequences in parameters, attackers could access sensitive files outside the intended directory, potentially leading to configuration leakage or arbitrary file access.
- CWE(s)
- KEV Date Added
- 19 May 2025
Related Threats
Threat-Actor AttributionAI
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Input validation directly neutralizes '../' sequences in externally-supplied pathnames before they are resolved.
Enforced access authorizations can limit the damage even when path traversal succeeds.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input validation and path sanitization that prevent ../ traversal.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure coding standards require neutralizing ../ sequences and canonicalizing paths before file operations.
Security testing in development catches path-traversal flaws before release.
Secure SDLC mandates input validation and path canonicalization that directly block ../ traversal.
Application security requirements explicitly call for controls against path traversal in file-handling functions.
Secure architecture principles reduce attack surface but do not prescribe the specific coding fix.
Information access restriction limits which files can be reached, mitigating impact of traversal.