Is CVE-2025-27920 exploited in the wild?

Yes. CVE-2025-27920 is known to be exploited in the wild, first recorded on 19 May 2025. Treat it as urgent.

How severe is CVE-2025-27920?

Critical severity, with a CVSS score of 8.8, published 19 May 2025.

Which products and versions are affected?

Srimax Output Messenger before 2.0.63.

Is there a fix for CVE-2025-27920?

A patch was published on 2025-05-19: Vendor advisory and fix released in version 2.0.63 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-27920 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-27920?

Check whether you run Srimax Output Messenger at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-27920: Srimax Output Messenger directory traversal

CVE-2025-27920 · Severity: critical · CVSS 8.8 · Exploited in the wild · Published 2025-05-19

Srimax Output Messenger, a private instant messaging tool for businesses, contains a security flaw that allows unauthorized access to files on the server. An attacker can exploit this to steal sensitive configuration data or internal documents, potentially compromising the entire communication platform. This vulnerability has been actively exploited in the wild for regional espionage.

Quick answers

Is CVE-2025-27920 exploited in the wild?: Yes. CVE-2025-27920 is known to be exploited in the wild, first recorded on 19 May 2025. Treat it as urgent.
How severe is CVE-2025-27920?: Critical severity, with a CVSS score of 8.8, published 19 May 2025.
Which products and versions are affected?: Srimax Output Messenger before 2.0.63.
Is there a fix for CVE-2025-27920?: A patch was published on 2025-05-19: Vendor advisory and fix released in version 2.0.63 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-27920 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-27920?: Check whether you run Srimax Output Messenger at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A directory traversal vulnerability (CWE-24/CWE-22) exists in Srimax Output Messenger versions prior to 2.0.63 due to improper file path handling. By injecting '../' sequences into specific parameters, a network-based attacker can bypass directory restrictions to read or write arbitrary files on the host system. While some assessments suggest low privileges are required, others indicate it may be exploitable without authentication. This flaw has been utilized as a zero-day by threat actors for espionage purposes. Users should update to version 2.0.63 or later to remediate the issue.

Affected products

Srimax Output Messenger before 2.0.63

Timeline

2025-05-05: disclosed: Initial CVE publication
2025-05-12: other: Microsoft reports zero-day exploitation by 'Marbled Dust' group
2025-05-19: kev added: CISA added to Known Exploited Vulnerabilities catalog
2025-05-19: patched: Vendor advisory and fix released in version 2.0.63

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.