CVE-2025-27920

What it actually does

CVE-2025-27920 is a path traversal vulnerability in Output Messenger before version 2.0.63 caused by improper validation and normalization of file path parameters. An attacker can include traversal sequences such as ../ or encoded equivalents in a request parameter to escape the intended application directory and read files elsewhere on the server. Depending on the files accessible to the Output Messenger process, this can expose configuration files, credentials, message-related data, application secrets, logs, certificates, or operating system files. The vulnerability is listed in CISA KEV and has active in-the-wild exploitation, indicating real attacker use rather than only theoretical exploitability.

Why it matters to the business

Successful exploitation can expose sensitive business communications, server configuration, credentials, and other files readable by the messaging application. This may enable follow-on compromise, lateral movement, data theft, service disruption, or unauthorized access to internal systems. Because the vulnerability is in CISA KEV with a remediation deadline of 2025-06-09 and is reported as actively exploited in the wild, organizations running affected Output Messenger versions should treat it as urgent even though the EPSS score is relatively low.

How an attack unfolds

An attacker first identifies an exposed Output Messenger instance running a vulnerable version before 2.0.63. They then target a file-accessible request parameter and supply path traversal payloads such as ../ sequences, double-encoded traversal strings, or mixed slash variants to bypass weak path handling. If the application fails to constrain the requested path to the intended directory, the server returns files outside the authorized location. The attacker typically starts with low-risk proof files, then attempts to retrieve configuration files, logs, credentials, certificates, database connection strings, or application data. Information obtained from those files can be used to authenticate elsewhere, understand the deployment, pivot to other systems, or prepare additional attacks. Public reporting associates exploitation activity with the Srimax Output Messenger directory traversal vulnerability campaign context, so defenders should assume opportunistic scanning and targeted exploitation are both plausible.

How to fix it

Upgrade Output Messenger to version 2.0.63 or later. If immediate upgrade is not possible, restrict access to the Output Messenger service to trusted networks or VPN users, block requests containing traversal sequences at a reverse proxy or WAF, and ensure the application service account has the least possible filesystem read permissions. Review any file download, attachment, or resource retrieval functionality for strict allowlisting, canonical path validation, and enforcement that resolved paths remain inside the intended directory. Because this CVE is in CISA KEV, remediation should have been completed by 2025-06-09 for organizations subject to BOD 22-01 and should be prioritized immediately wherever still present.

How to confirm the fix worked

Confirm the deployed Output Messenger version is 2.0.63 or later. Validate that all internet-facing and internally reachable instances have been inventoried, including secondary servers, test systems, and backup installations. Where authorized, perform a safe negative test using benign traversal payloads against file-access functions and verify the server rejects the request rather than returning files outside the intended directory. Review reverse proxy, web server, and application logs for traversal attempts before and after remediation. Confirm compensating controls such as WAF rules, access restrictions, and least-privilege filesystem permissions are active, but do not treat them as substitutes for upgrading.

Typical attack path

1. Discover an internet-facing or reachable Output Messenger deployment.
2. Fingerprint the application version or infer vulnerability from behavior.
3. Send crafted requests containing ../, ..\\, URL-encoded traversal, or double-encoded traversal sequences in file path parameters.
4. Confirm file read by requesting a predictable benign file or application resource outside the intended directory.
5. Attempt to read higher-value files such as application configuration, logs, credential stores, certificates, or operating system files.
6. Use exposed secrets or configuration details for follow-on access, privilege escalation, lateral movement, or data theft.
7. Delete or avoid noisy activity where possible, while continuing automated file enumeration.

How to detect it

To determine whether this was already exploited, review web server, reverse proxy, WAF, load balancer, and Output Messenger application logs for requests containing traversal patterns and suspicious file-read attempts. Focus on the period before upgrade, especially since public disclosure on 2025-05-05 and the KEV remediation window ending 2025-06-09, but include earlier retained logs if available. Look for HTTP 200 responses or unusually large responses to requests containing ../, ..\\, URL-encoded traversal, double-encoded traversal, or attempts to access configuration, log, password, certificate, or operating system files. Correlate suspicious requests with source IPs, user agents, authentication status, session identifiers, and subsequent activity such as successful logins, administrative actions, new remote access sessions, or connections to internal systems. On the host, inspect application logs, access logs, and file access audit logs for reads of sensitive files by the Output Messenger service account. If exploitation is suspected, preserve logs, capture volatile process and network state where possible, and rotate any secrets that may have been exposed.

• ../
• ..\\
• %2e%2e%2f
• %2e%2e%5c
• ..%2f
• ..%5c
• %252e%252e%252f
• %252e%252e%255c
• ....//
• ....\\
• /etc/passwd
• /etc/shadow
• /etc/hosts
• /proc/self/environ
• /proc/self/cmdline
• boot.ini
• win.ini
• Windows/System32/drivers/etc/hosts
• web.config
• app.config
• .env
• id_rsa
• authorized_keys
• server.xml
• application.properties
• database.properties

What your security team should do

• Immediately identify all Output Messenger deployments and confirm whether any are running versions before 2.0.63.
• Upgrade affected systems to Output Messenger 2.0.63 or later as the primary fix.
• Prioritize remediation because the vulnerability is in CISA KEV, has active in-the-wild exploitation, and had a KEV due date of 2025-06-09.
• If patching is delayed, restrict service exposure, require VPN or trusted-network access, and add WAF or reverse-proxy rules blocking traversal payloads.
• Search historical logs for traversal indicators, especially requests containing ../, encoded traversal strings, or attempts to read configuration and operating system files.
• Rotate credentials, API keys, database passwords, certificates, and tokens that may have been stored in files readable by the Output Messenger service if exploitation is suspected.
• Review file permissions for the Output Messenger runtime account and remove unnecessary read access to sensitive directories.
• Monitor for follow-on activity using exposed credentials, unusual authentication events, new remote access sessions, and unexpected access to internal services.