Path Traversal Vulnerability in TRUfusion Enterprise by Rocket Software
CVE-2025-27222

8.6HIGH

Key Information:

Vendor

Rocket Software

Status
TRUfusion Enterprise
Vendor
CVE Published:
27 October 2025

What is CVE-2025-27222?

The TRUfusion Enterprise application, up to version 7.10.4.0, is susceptible to a path traversal vulnerability due to improper input sanitization in the /trufusionPortal/getCobrandingData endpoint. This flaw allows attackers to manipulate file paths, potentially enabling unauthorized access to sensitive files hosted on the server. Additionally, this vulnerability poses a risk of leaking cleartext passwords for the TRUfusion software itself, highlighting critical security flaws that need immediate attention. Organizations using TRUfusion Enterprise should assess their systems and apply necessary mitigations to protect against potential exploitation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

https://www.rocketsoftware.com/products/rocket-b2b-supply...
https://www.rcesecurity.com/2025/09/when-audits-fail-four...
https://github.com/MrTuxracer/advisories/blob/master/CVEs...

EPSS Score

5% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.