CRITICAL🇵🇱 Wersja polska

CVE-2025-59793

CVSS 9.4v4.0pub. 2026-02-17upd. 2026-04-03

Rocket TRUfusion Enterprise through 7.10.5 exposes the endpoint at /axis2/services/WsPortalV6UpDwAxis2Impl to authenticated users to be able to upload files. However, the application doesn't properly sanitize the jobDirectory parameter, which allows path traversal sequences to be included. This allows writing files to arbitrary local filesystem locations and may subsequently lead to remote code execution.

CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Rocketsoftware Trufusion Enterprise

    APP
    Rocketsoftware
    < 7.10.5.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCEPath Traversal
CWE
References

Related vulnerabilities

CVE-2025-27224CRITICAL9.8PL ✓ten sam produkt

Path Traversal w Rocket TRUfusion Enterprise – zapis dowolnych plików i RCE

CVE-2025-32355HIGH7.9ten sam produkt

Rocket TRUfusion Enterprise through 7.10.4.0 uses a reverse proxy to handle incoming connections. However, the...

CVE-2025-27223HIGH7.5ten sam produkt

TRUfusion Enterprise through 7.10.4.0 exposes the encrypted COOKIEID as an authentication mechanism for some e...

CVE-2025-27222HIGH8.6ten sam produkt

TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/getCobrandingData endpoint to retrieve files. ...

CVE-2025-27225HIGH7.5ten sam produkt

TRUfusion Enterprise through 7.10.4.0 exposes the /trufusionPortal/jsp/internal_admin_contact_login.jsp endpoi...