Secuno
ENNL
Book demo

CVE-2025-27920

Srimax Output Messenger Directory Traversal

7.2 HIGHActively exploited (CISA KEV)EPSS 1.86%
  1. Published5 May 2025
  2. Added to CISA KEV19 May 2025
  3. Remediation due9 Jun 2025
Actively exploited (CISA KEV)

Srimax Output Messenger contains a directory traversal vulnerability that allows an attacker to access sensitive files outside the intended directory, potentially leading to configuration leakage or arbitrary file access.

Added to KEV: 19 May 2025Federal remediation due: 9 Jun 2025

Description

Output Messenger before 2.0.63 was vulnerable to a directory traversal attack through improper file path handling. By using ../ sequences in parameters, attackers could access sensitive files outside the intended directory, potentially leading to configuration leakage or arbitrary file access.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeChanged
ConfidentialityLow
IntegrityLow
AvailabilityNone
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Affected products

Srimax Output Messenger< 2.0.63

Remediation

Fixed in
Srimax Output Messenger≥ 2.0.63

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-1089808.8
Blinko through 1.8.8 allows directory traversal, overwriting startup files as root, via…
CVE-2026-977308.5
In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File…
CVE-2026-661408.4
Exim before 4.99.5 allows directory traversal to access files outside of the spool…
CVE-2026-228108.2
Joplin is an open source note-taking and to-do application that organises notes and…
CVE-2026-403188.5
SiYuan is an open-source personal knowledge management system. In versions 3.6.3 and…
CVE-2026-398139.8
A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through…

Frequently asked

Is CVE-2025-27920 being actively exploited?

Yes. CVE-2025-27920 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 19 May 2025.

How severe is CVE-2025-27920?

CVE-2025-27920 has a CVSS 3.1 base score of 7.2, rated high. EPSS estimates a 1.86% probability of exploitation.

Which products are affected by CVE-2025-27920?

Affected products include Srimax Output Messenger.

How do I fix CVE-2025-27920?

Upgrade affected software to a fixed version, for example Srimax Output Messenger 2.0.63 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2025-27920 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.