CVE-2025-27920
Srimax Output Messenger Directory Traversal Vulnerability
Description
CVE-2025-27920 is a high-severity directory traversal vulnerability in Srimax Output Messenger, an enterprise messaging application, affecting all versions prior to 2.0.63. The flaw allows an unauthenticated attacker to use ../ path traversal sequences to access files outside the intended directory, potentially exposing sensitive configuration files, credentials, and arbitrary server data. With a CVSS v3.1 base score of 7.2 and the vulnerability being actively exploited in a state-sponsored espionage campaign, CVE-2025-27920 represents a critical threat. CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of June 9, 2025, and its EPSS score of 46.08% at the 97th percentile indicates an exceptionally high probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:NOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| srimax | output messenger | < 2.0.63 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://www.outputmessenger.com/cve-2025-27920/(Vendor Advisory)
- https://www.srimax.com/products-2/output-messenger/(Product)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-27920(US Government Resource)
- https://www.microsoft.com/en-us/security/blog/2025/05/12/marbled-dust-leverages-zero-day-in-output-messenger-for-regional-espionage/(Mitigation, Third Party Advisory)
Weakness Type
CWE-24: Path Traversal: '../filedir'
CVE-2025-27920 is classified under CWE-24, a specific variant of path traversal where the application fails to neutralize ../ sequences in user-supplied input, allowing attackers to escape the intended directory and access files elsewhere on the filesystem. In Output Messenger, the server does not properly validate file path parameters, enabling attackers to traverse parent directories and read sensitive files such as configuration data, database credentials, or user information stored on the server.
Learn more: CWE-24 — Path Traversal: '../filedir'
Impact Analysis
CVE-2025-27920 carries a CVSS v3.1 base score of 7.2 (High) and is remotely exploitable over the network (AV:N) with low complexity (AC:L), requiring no authentication (PR:N) and no user interaction (UI:N). The scope is changed (S:C), meaning exploitation can affect resources beyond the vulnerable Output Messenger component. While the direct confidentiality and integrity impacts are rated low (C:L/I:L), the real-world significance is amplified considerably by the confirmed use of this vulnerability in a state-sponsored espionage campaign attributed to the Turkish-linked threat actor Marbled Dust, as documented by Microsoft. The directory traversal allows attackers to exfiltrate sensitive server files, potentially including credentials that enable lateral movement. The EPSS score of 46.08% at the 97th percentile places this among the most actively targeted vulnerabilities, and the absence of any authentication requirement means any network-accessible Output Messenger instance is at risk.
Exploit Maturity
CVE-2025-27920 shows very high exploit maturity, having been weaponized in a real-world espionage campaign. CISA has confirmed active exploitation in the wild by adding it to the KEV catalog. Microsoft's Threat Intelligence team published a detailed analysis documenting exploitation by the threat actor Marbled Dust, who leveraged CVE-2025-27920 as a zero-day for regional espionage operations. The EPSS score of 46.08% at the 97th percentile indicates near-certain exploitation activity. The combination of zero-day exploitation in state-sponsored campaigns, confirmed KEV status, and the trivial nature of directory traversal attacks makes immediate patching essential for all Output Messenger deployments.
Remediation
- Upgrade Output Messenger immediately. Update to version 2.0.63 or later, which addresses the directory traversal vulnerability. The vendor advisory at outputmessenger.com/cve-2025-27920 provides upgrade instructions.
- Restrict network access to Output Messenger servers. Implement firewall rules and network segmentation to limit access to the Output Messenger server to only authorized internal networks. Do not expose the server directly to the internet.
- Conduct a forensic investigation. Given the confirmed exploitation by state-sponsored actors, review server logs for evidence of directory traversal attempts, specifically requests containing
../sequences. Check for unauthorized file access, especially to configuration files, database files, and credential stores. Microsoft's advisory provides indicators of compromise to assist in detection. - Rotate all credentials stored on the server. Assume any credentials, API keys, or configuration data stored on the Output Messenger server may have been compromised. Rotate database passwords, service account credentials, and any integration tokens.
- Deploy a web application firewall (WAF). Configure WAF rules to detect and block requests containing path traversal patterns such as
../,..\, and their encoded variants as an additional layer of defense.
Technical Details
CVE-2025-27920 is a directory traversal vulnerability in Srimax Output Messenger's file handling mechanism. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N confirms a network-accessible attack requiring no privileges, no user interaction, with changed scope and low impacts on confidentiality and integrity.
The vulnerability arises because the Output Messenger server accepts file path parameters without properly validating or canonicalizing them. An attacker can include ../ directory traversal sequences in these parameters to escape the application's intended file directory and access arbitrary files on the server's filesystem. The server processes the traversal sequences rather than rejecting or normalizing them, allowing path resolution to reach parent directories and ultimately any file readable by the Output Messenger process. This is a classic CWE-24 pattern where the application constructs a file path by concatenating a base directory with user-supplied input but fails to strip or reject relative path components before performing the file operation.
Frequently Asked Questions
Is CVE-2025-27920 being actively exploited?
Yes. CISA has confirmed active exploitation by adding CVE-2025-27920 to the KEV catalog. Microsoft Threat Intelligence has documented its exploitation by the state-sponsored threat actor Marbled Dust in a regional espionage campaign targeting Output Messenger deployments.
What products are affected by CVE-2025-27920?
Srimax Output Messenger versions prior to 2.0.63 are affected. Organizations should upgrade to version 2.0.63 or later to remediate the directory traversal vulnerability.
How do I fix CVE-2025-27920?
Update Output Messenger to version 2.0.63 or later. Additionally, restrict network access to the server, conduct a forensic investigation for signs of compromise, and rotate any credentials that may have been stored on the server.
How severe is CVE-2025-27920?
CVE-2025-27920 has a CVSS v3.1 base score of 7.2 (High). It requires no authentication or user interaction and is exploitable over the network. The EPSS score of 46.08% at the 97th percentile indicates a very high likelihood of exploitation, and its use in a state-sponsored espionage campaign underscores the severity.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.