Path Traversal Vulnerability in TRUfusion Enterprise by Rocket Software
CVE-2025-27224

9.8CRITICAL

Key Information:

Vendor

Rocket Software

Status
TRUfusion Enterprise
Vendor
CVE Published:
27 October 2025

What is CVE-2025-27224?

TRUfusion Enterprise versions up to 7.10.4.0 are vulnerable due to insufficient input validation on the /trufusionPortal/fileupload endpoint. This flaw allows attackers to exploit path traversal sequences, enabling them to upload files with arbitrary names and types to any location on the server. This could lead to unauthorized file execution and potentially compromise the integrity of the system.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

https://www.rocketsoftware.com/products/rocket-b2b-supply...
https://www.rcesecurity.com/2025/09/when-audits-fail-four...
https://github.com/MrTuxracer/advisories/blob/master/CVEs...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.