Actively exploited · Published May 5, 2025 · Assigned by mitre
CVE-2025-27920
High 7.2 Exploited
In plain English
A high-severity security flaw in Output Messenger from Srimax. Attackers are actively exploiting it in the wild (listed by CISA on May 19, 2025). The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 80% of all known vulnerabilities). Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Jun 9, 2025.
Official description
Output Messenger before 2.0.63 was vulnerable to a directory traversal attack through improper file path handling. By using ../ sequences in parameters, attackers could access sensitive files outside the intended directory, potentially leading to configuration leakage or arbitrary file access.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Srimax | Output Messenger | 0 – before 2.0.63 |
Weakness: CWE-24 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
References
- https://www.srimax.com/products-2/output-messenger/
- https://www.outputmessenger.com/cve-2025-27920/
- https://www.microsoft.com/en-us/security/blog/2025/05/12/marbled-dust-leverages-zero-day-in-output-messenger-for-regional-espionage/ third-party-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-27920 government-resource