Path traversal in Output Messenger - CVE-2025-27920

Detailed vulnerability description

The vulnerability allows a remote user to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences. A remote authenticated user can upload malicious files to an arbitrary location on the system and execute them, leading to full system compromise.

Note, the vulnerability is being actively exploited in the wild.

How to mitigate CVE-2025-27920

Sources

• https://www.outputmessenger.com/cve-2025-27920/
• https://www.microsoft.com/en-us/security/blog/2025/05/12/marbled-dust-leverages-zero-day-in-output-messenger-for-regional-espionage/