Path Traversal in Rocketsoftware Trufusion Enterprise
CVE-2025-59793
Rocket TRUfusion Enterprise through 7.10.5 exposes the endpoint at /axis2/services/WsPortalV6UpDwAxis2Impl to authenticated users to be able to upload files. However, the application doesn't properly sanitize the jobDirectory parameter, which allows path traversal sequences to be included. This allows writing files to arbitrary local filesystem locations and may subsequently lead to remote code execution.
EPSS: 0.010 (60.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
Affected products
- Rocketsoftware Trufusion_enterprise
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (Not Applicable)
- cve@mitre.org (Product)
- cve@mitre.org (Product)
- cve@mitre.org (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2025-59793?
- CVE-2025-59793 is a critical-severity vulnerability in Rocketsoftware Trufusion Enterprise, classified under Path Traversal: '.../...//'. CVSS score: 9.9/10. Published 2026-02-17.
- How severe is CVE-2025-59793?
- Critical severity. CVSS v3 base score is 9.9 out of 10.