Path Traversal in Rocketsoftware Trufusion Enterprise
CVE-2025-59793
Rocket TRUfusion Enterprise through 7.10.5 exposes the endpoint at /axis2/services/WsPortalV6UpDwAxis2Impl to authenticated users to be able to upload files. However, the application doesn't properly sanitize the jobDirectory parameter, which allows path traversal sequences to be included. This allows writing files to arbitrary local filesystem locations and may subsequently lead to remote code execution.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.011 (63.4th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 63rd percentile — 63.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.010 · newest: 0.011 · change: +0.000
Affected products
Weakness classification (CWE)
References
- www.rcesecurity.com (Not Applicable)
- www.rocketsoftware.com/products/rocket-b2b-supply-chain-integration/rocket-truf… (Product)
- www.rocketsoftware.com/en-us/products/b2b-supply-chain-integration/trufusion (Product)
- www.rcesecurity.com/advisories/cve-2025-59793/ (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2025-59793?
- CVE-2025-59793 is a critical-severity vulnerability in Rocketsoftware Trufusion Enterprise, classified under Path Traversal: '.../...//'. CVSS score: 9.9/10. Published 2026-02-17.
- How severe is CVE-2025-59793?
- Critical severity. CVSS v3 base score is 9.9 out of 10.