#VU109018 Path traversal in Output Messenger - CVE-2025-27920
Published: May 13, 2025
Vulnerability identifier: #VU109018
Vulnerability risk: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Amber
CVE-ID: CVE-2025-27920
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerable software:
Output Messenger
Output Messenger
Software vendor:
Srimax Software System
Srimax Software System
Description
The vulnerability allows a remote user to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences. A remote authenticated user can upload malicious files to an arbitrary location on the system and execute them, leading to full system compromise.
Note, the vulnerability is being actively exploited in the wild.
Remediation
Install updates from vendor's website.