How severe is CVE-2025-27920?

CVE-2025-27920 has a CVSS 3.x base score of 7.2, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2025-27920 being actively exploited?

Yes. CVE-2025-27920 is on CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2025-05-19, which means active exploitation has been confirmed. It should be prioritised for remediation.

What products are affected by CVE-2025-27920?

CVE-2025-27920 affects Srimax Output Messenger. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-27920?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Because this CVE is known to be actively exploited, treat remediation as urgent — CISA KEV typically sets a short remediation deadline.

Does CVE-2025-27920 have an EU (EUVD) identifier?

Yes. CVE-2025-27920 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-13464. It is also flagged as exploited in the EUVD (since 2025-05-19).

When was CVE-2025-27920 published?

CVE-2025-27920 was published on 2025-05-05 and last updated on 2026-06-17.

CVE-2025-27920

CVE-2025-27920 is a high-severity vulnerability in Srimax Output Messenger with a CVSS 3.x base score of 7.2. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming it has been exploited in the wild (added 2025-05-19). The underlying weakness is classified as CWE-24.

Key facts

Severity: High (CVSS 3.x base score 7.2)
EPSS exploit prediction: 2% (76th percentile)
Actively exploited: Yes — listed in CISA KEV (added 2025-05-19)
EU (EUVD) id: EUVD-2025-13464
EU exploitation: Flagged exploited in the ENISA EU Vulnerability Database (since 2025-05-19)
Weakness: CWE-24
Affected product: Srimax Output Messenger
Published: 2025-05-05
Last modified: 2026-06-17

Description

Output Messenger before 2.0.63 was vulnerable to a directory traversal attack through improper file path handling. By using ../ sequences in parameters, attackers could access sensitive files outside the intended directory, potentially leading to configuration leakage or arbitrary file access.

Frequently asked questions

What is CVE-2025-27920?: Output Messenger before 2.0.63 was vulnerable to a directory traversal attack through improper file path handling. By using ../ sequences in parameters, attackers could access sensitive files outside the intended directory, potentially leading to configuration leakage or arbitrary file access.
How severe is CVE-2025-27920?: CVE-2025-27920 has a CVSS 3.x base score of 7.2, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2025-27920 being actively exploited?: Yes. CVE-2025-27920 is on CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2025-05-19, which means active exploitation has been confirmed. It should be prioritised for remediation.
What products are affected by CVE-2025-27920?: CVE-2025-27920 affects Srimax Output Messenger. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-27920?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Because this CVE is known to be actively exploited, treat remediation as urgent — CISA KEV typically sets a short remediation deadline.
Does CVE-2025-27920 have an EU (EUVD) identifier?: Yes. CVE-2025-27920 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-13464. It is also flagged as exploited in the EUVD (since 2025-05-19).
When was CVE-2025-27920 published?: CVE-2025-27920 was published on 2025-05-05 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:srimax:output_messenger:*:*:*:*:*:*:*:*

More vulnerabilities in Srimax Output Messenger

CVE-2025-27921 — Medium (CVSS 6.1): A reflected cross-site scripting (XSS) vulnerability was discovered in Output Messenger before 2.0.63, where…

All CVEs affecting Srimax Output Messenger →

Other CWE-24 vulnerabilities

CVE-2026-39813 — Critical (CVSS 9.8): A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through…
CVE-2026-49103 — Critical (CVSS 9.4): Webmin before 2.640 does not safely construct a filename for saving of an attachment within the mailboxes component.…
CVE-2025-61318 — Critical (CVSS 9.1): Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability. This vulnerability stems from the admin/template.php…
CVE-2023-6699 — Critical (CVSS 9.1): The WP Compress – Image Optimizer [All-In-One] plugin for WordPress is vulnerable to Directory Traversal in all…
CVE-2025-54769 — High (CVSS 8.8): An authenticated, read-only user can upload a file and perform a directory traversal to have the uploaded file placed…
CVE-2025-60344 — High (CVSS 8.6): A path traversal (directory traversal) vulnerability in D-Link DSR series routers allows unauthenticated remote…

Browse all CWE-24 vulnerabilities →