{"id":"CVE-2025-27920","kind":"vulnerability","aliases":["CVE-2025-27920"],"related":[],"title":"srimax output messenger: Output Messenger before 2.0.63 was vulnerable to a directory traversal attack through improper file path handling","description":"Srimax Output Messenger contains a directory traversal vulnerability that allows an attacker to access sensitive files outside the intended directory, potentially leading to configuration leakage or arbitrary file access.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"Srimax Output Messenger, an enterprise chat application, has a directory traversal flaw that lets a request reach files outside its intended folder. An attacker can read sensitive files such as configuration data, and CISA reports active exploitation.","severity":"high","cvss":8.8,"epss":null,"exploited":true,"exploited_at":"2025-05-19T00:00:00+00:00","products":[{"name":"srimax output messenger","fixed":["2.0.63"],"affected":"< 2.0.63","ecosystem":"vendor"},{"name":"Srimax Output Messenger","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["enterprise-chat","exploited","other","srimax-output-messenger"],"not_affected_if":["product-not-deployed"],"how_to_check":"Identify any Srimax Output Messenger servers or clients in your environment; the sources do not give a version check or file path.","fix":"Apply the vendor mitigations per CISA guidance, or discontinue use of the product if mitigations are unavailable. Affected and fixed versions: unknown.","status":"open","published_at":"2025-05-05T16:15:50+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:48:29+00:00","updated_at":"2026-10-24T00:09:50+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-23T20:48:29Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigations per CISA guidance, or discontinue use of the product if mitigations are unavailable. Affected and fixed versions: unknown.","reach":"unknown","summary":"Srimax Output Messenger, an enterprise chat application, has a directory traversal flaw that lets a request reach files outside its intended folder. An attacker can read sensitive files such as configuration data, and CISA reports active exploitation.","category":"other","who_cares":["srimax-output-messenger","enterprise-chat"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker reads configuration files and other sensitive files from the server.","analyst_note":"Find the vendor advisory and affected/fixed versions and the exact mitigation steps; check the CISA KEV entry for the due date and the request path used in exploitation.","how_to_check":"Identify any Srimax Output Messenger servers or clients in your environment; the sources do not give a version check or file path.\nunknown\nunknown","needs_analyst":true,"not_affected_if":["product-not-deployed"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00046,"input_tokens":2548,"output_tokens":411,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':119C '-2025':21A,24A '-27920':22A,25A '2.0.63':7A '22':118C 'access':91C,106C 'action':109C 'activ':76B 'allow':87C 'appli':110C 'applic':47B,116C 'arbitrari':104C 'attack':14A,64B,89C 'bod':117C 'chat':34B,46B 'cisa':74B,107C 'cloud':122C 'configur':71B,101C 'contain':81C 'cve':20A,23A 'data':72B 'directori':12A,50B,83C,97C 'discontinu':125C 'enterpris':33B,45B 'enterprise-chat':32B 'exploit':35B,77B 'file':17A,58B,68B,93C,105C 'flaw':52B 'folder':62B 'follow':115C 'guidanc':120C 'handl':19A 'improp':16A 'instruct':114C 'intend':61B,96C 'lead':99C 'leakag':102C 'let':54B 'messeng':3A,5A,40B,43B,80C 'messenger':28A,31A 'mitig':111C,131C 'output':2A,4A,27A,30A,39B,42B,79C 'outsid':59B,94C 'path':18A 'per':112C 'potenti':98C 'product':129C 'reach':57B 'read':66B 'report':75B 'request':56B 'requir':108C 'sensit':67B,92C 'servic':123C 'srimax':1A,26A,29A,38B,41B,78C 'srimax-output-messeng':37B 'travers':13A,51B,84C 'unavail':133C 'use':126C 'vendor':113C 'vulner':9A,85C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-05-05T16:15:50+00:00","kev":{"dateAdded":"2025-05-19","dueDate":"2025-06-09","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-27920","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-27920","severity":null,"published_at":"2025-05-19T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T16:39:46+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-27920","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27920","severity":null,"published_at":"2025-05-05T16:15:50+00:00","modified_at":"2026-06-17T09:04:23+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}