CVE-2025-27920 is a directory traversal vulnerability affecting Srimax Output Messenger versions prior to 2.0.63. Attackers can exploit improper file path handling using "../" sequences to access sensitive files, potentially leading to configuration leakage or arbitrary file access. This vulnerability carries a CVSS score of 8.8 (HIGH) due to its network-accessible, low-privilege attack vector and high impact on confidentiality, integrity, and availability. Notably, CVE-2025-27920 is actively exploited as a zero-day, with evidence of nation-state actors leveraging it in espionage campaigns. While no public exploit code is available, it has garnered significant community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2.0.63CPE matchmatch criteria | cpe:2.3:a:srimax:output_messenger:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.