CVE-2025-27222

Katalog CVE

CVSS 8.6 · High EPSS 2,0%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada rocketsoftware trufusion enterprise. Skor CVSS 3.1 8.6 (High) menurut CISA ADP.

Deskripsi (NVD)

TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/getCobrandingData endpoint to retrieve files. However, the application doesn't properly sanitize the input to this endpoint, ultimately allowing path traversal sequences to be included. This can be used to read any local server file that is accessible by the TRUfusion user and can also be used to leak cleartext passwords of TRUfusion Enterprise itself.

Rincian

Terbit di NVD

27 Oktober 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.6 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-35: Path Traversal: '.../...//'

EPSS (30 hari)

2,0% peluang dieksploitasi; lebih tinggi dari 80,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2025-27222.txt exploit · advisory pihak ketiga
• https://www.rcesecurity.com/2025/09/when-audits-fail-four-critical-pre-auth-vulnerabilities-in-trufusion-enter... exploit · advisory pihak ketiga
• https://www.rocketsoftware.com/products/rocket-b2b-supply-chain-integration/rocket-trufusion-enterprise product