CVE-2025-27222
However, the application doesn't properly sanitize the input to this endpoint, ultimately allowing path traversal sequences to be included.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.87%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/getCobrandingData endpoint to retrieve files. However, the application doesn't properly sanitize the input to this endpoint, ultimately allowing path traversal sequences to be included. This can be used to read any local server file that is accessible by the TRUfusion user and can also be used to leak cleartext passwords of TRUfusion Enterprise itself.
- CVSS 3.1
- 8.6 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
- EPSS
- 1.87% probability · 78th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22, CWE-35
- Affected
- rocketsoftware/trufusion enterprise
- Source
- cve@mitre.org
References
- https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2025-27222.txtExploit, Third Party Advisory
- https://www.rcesecurity.com/2025/09/when-audits-fail-four-critical-pre-auth-vulnerabilities-in-trufusion-enterprise/Exploit, Third Party Advisory
- https://www.rocketsoftware.com/products/rocket-b2b-supply-chain-integration/rocket-trufusion-enterpriseProduct
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.