CVE-2025-27920

HIGH
2025-05-05 [email protected]
7.2
CVSS 3.1
Share

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

3
Analysis Generated
Mar 28, 2026 - 18:40 vuln.today
Added to CISA KEV
Nov 05, 2025 - 19:28 cisa
CISA KEV
CVE Published
May 05, 2025 - 16:15 nvd
HIGH 7.2

Tags

Path Traversal Output Messenger

Description

Output Messenger before 2.0.63 was vulnerable to a directory traversal attack through improper file path handling. By using ../ sequences in parameters, attackers could access sensitive files outside the intended directory, potentially leading to configuration leakage or arbitrary file access.

Analysis

Output Messenger before 2.0.63 contains a directory traversal vulnerability enabling attackers to access files outside the intended directory through path manipulation in parameters.

Technical Context

The CWE-24 path traversal allows crafted requests with directory traversal sequences to read configuration files, credentials, and other sensitive data from the Output Messenger server's filesystem.

Affected Products

['Output Messenger before 2.0.63']

Remediation

Update to 2.0.63+. Review server for evidence of unauthorized file access.

Priority Score

138
Low Medium High Critical
KEV: +50
EPSS: +52.0
CVSS: +36
POC: 0

Share

CVE-2025-27920 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy