{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-07T18:56:48.525","vulnerabilities":[{"cve":{"id":"CVE-2025-27920","sourceIdentifier":"cve@mitre.org","published":"2025-05-05T16:15:50.857","lastModified":"2025-11-05T19:28:43.010","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Output Messenger before 2.0.63 was vulnerable to a directory traversal attack through improper file path handling. By using ../ sequences in parameters, attackers could access sensitive files outside the intended directory, potentially leading to configuration leakage or arbitrary file access."},{"lang":"es","value":"Output Messenger, antes de la versión 2.0.63, era vulnerable a un ataque de salto de directorio debido a la gestión incorrecta de las rutas de archivo. Al usar secuencias ../ en los parámetros, los atacantes podían acceder a archivos confidenciales fuera del directorio previsto, lo que podía provocar fugas de configuración o acceso arbitrario a archivos."}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"cisaExploitAdd":"2025-05-19","cisaActionDue":"2025-06-09","cisaRequiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","cisaVulnerabilityName":"Srimax Output Messenger Directory Traversal Vulnerability","weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-24"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:srimax:output_messenger:*:*:*:*:*:*:*:*","versionEndExcluding":"2.0.63","matchCriteriaId":"A3F0B13C-91AE-4C97-A674-451972BF2C4D"}]}]}],"references":[{"url":"https://www.outputmessenger.com/cve-2025-27920/","source":"cve@mitre.org","tags":["Vendor Advisory"]},{"url":"https://www.srimax.com/products-2/output-messenger/","source":"cve@mitre.org","tags":["Product"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-27920","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["US Government Resource"]},{"url":"https://www.microsoft.com/en-us/security/blog/2025/05/12/marbled-dust-leverages-zero-day-in-output-messenger-for-regional-espionage/","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Mitigation","Third Party Advisory"]}]}}]}