Paper/Archive/CVE-2025-59793

CVE-2025-59793

mitre — Rocket TRUfusion Enterprise through 7.10.5 exposes the endpoint at /axis2/services/WsPortalV6UpDwAxis2Impl to authenticated users to be a…

EPSS 1%public exploit CVSS 9.9

critical.is priorityof 100

CVSS 9.9 (ADP)9.9 / 10 × 3029.7 Not in CISA KEV+300.0 EPSS percentile 66.4.664 × 2013.3 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

Rocket TRUfusion Enterprise through 7.10.5 exposes the endpoint at /axis2/services/WsPortalV6UpDwAxis2Impl to authenticated users to be able to upload files. However, the application doesn't properly sanitize the jobDirectory parameter, which allows path traversal sequences to be included. This allows writing files to arbitrary local filesystem locations and may subsequently lead to remote code execution.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

Scores by source

CISA ADP9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA ADP9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refrcesecurity.com refrocketsoftware.com/products/rocket-b2b-supply-chain-integration/rocket-trufusion-enterprise refrocketsoftware.com/en-us/products/b2b-supply-chain-integration/trufusion refrcesecurity.com/advisories/cve-2025-59793