Skip to main content

Output Messenger CVE-2025-27920

HIGH
Path Traversal: '../filedir' (CWE-24)
2025-05-05 cve@mitre.org
Path Traversal Output Messenger
7.2
CVSS 3.1
Share

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

3
Analysis Generated
Mar 28, 2026 - 18:40 vuln.today
Added to CISA KEV
Nov 05, 2025 - 19:28 cisa
CISA KEV
CVE Published
May 05, 2025 - 16:15 nvd
HIGH 7.2

DescriptionNVD

Output Messenger before 2.0.63 was vulnerable to a directory traversal attack through improper file path handling. By using ../ sequences in parameters, attackers could access sensitive files outside the intended directory, potentially leading to configuration leakage or arbitrary file access.

AnalysisAI

Output Messenger before 2.0.63 contains a directory traversal vulnerability enabling attackers to access files outside the intended directory through path manipulation in parameters.

Technical ContextAI

The CWE-24 path traversal allows crafted requests with directory traversal sequences to read configuration files, credentials, and other sensitive data from the Output Messenger server's filesystem.

RemediationAI

Update to 2.0.63+. Review server for evidence of unauthorized file access.

Share

CVE-2025-27920 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy