CVE-2025-59793

The application exposes the /axis2/services/WsPortalV6UpDwAxis2Impl endpoint allowing authenticated users to upload files. The jobDirectory parameter is not properly validated or sanitized, allowing path traversal sequences (e.g., '../') to be included. An attacker can thus specify any location on the local server file system as the target for writing the uploaded file. Placing an appropriate file (e.g., webshell) in an accessible location can subsequently result in remote code execution on the server.

An authenticated attacker can write arbitrary files to a selected location on the server's file system, which as a result may lead to full server takeover through RCE.

Patches available from the vendor should be applied according to references. Additionally, it is recommended to restrict network access to the /axis2/services/WsPortalV6UpDwAxis2Impl endpoint exclusively to trusted and necessary users until the official patch is deployed.

Rocket TRUfusion Enterprise in versions up to and including 7.10.5