CVE-2025-27920: Srimax Output Messenger Directory Traversal Vulnerability
What It Is — Srimax Output Messenger fails to properly sanitize file‑path inputs, allowing an attacker to traverse directories and read files outside the intended location.
Exploitability — The vulnerability is publicly disclosed; proof‑of‑concept requests have been demonstrated. The NVD assigns a CVSS v3.1 base score of 7.5 (High).
Affected Products — Srimax Output Messenger (all versions prior to the vendor’s pending patch).
Why It Matters for Trust & Control Assurance
- Weak file‑system access controls breach the “access control” control objective that underpins many frameworks (NIST CSF, ISO 27001, etc.).
- Demonstrating remediation and continuous monitoring provides defensible audit evidence of due diligence.
- Enterprise buyers increasingly require proof that such control gaps are identified, patched, and evidentially tracked.
Recommended Actions
- Deploy the vendor‑released patch or apply the interim mitigation (e.g., input validation wrapper).
- Verify that all file‑path handling enforces strict whitelist sanitization and least‑privilege permissions.
- Update your access‑control policy to reflect the corrected file‑system boundaries.
- Capture remediation evidence in your control repository (e.g., Trust Center) to support audit readiness.
Source: CISA KEV – CVE‑2025‑27920