CVE-2025-27224
CRITICAL
INFO
Priority: 0.09
BB Relevance:
80/100
Published: 2025-10-27
Modified: 2026-11-05
First seen: 2026-11-05
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
None
S:
Unchanged
C:
High
I:
High
A:
High
Description
TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/fileupload endpoint to upload files. However, the application doesn't properly sanitize the input to this endpoint, ultimately allowing path traversal sequences to be included. This can be used to write to any filename with any file type at any location on the local server, ultimately allowing execution of arbitrary code.
Weakness Classification (1)
Affected Software (1)
| Vendor | Product | Version |
|---|---|---|
| rocketsoftware | trufusion_enterprise | < 7.10.4.0 |
References & Advisories (3)
Product
Exploit
Third Party Advisory
Exploit
Third Party Advisory