CVE-2025-27224
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk59th percentile - higher than 59% of all known CVEs
Summary
TRUfusion Enterprise through 7.10.4.0 does not properly sanitize input to the /trufusionPortal/fileupload endpoint, allowing path traversal sequences. This enables writing files with any filename and type to any location on the local server, ultimately leading to arbitrary code execution.
Risk Assessment
The vulnerability allows an attacker to achieve remote code execution on the application server, potentially leading to full system compromise and data breach.
Recommendation
Update TRUfusion Enterprise to a version later than 7.10.4.0 or apply the vendor patch; until then, restrict access to the /trufusionPortal/fileupload endpoint.
Other vulnerabilities in TRUfusion Enterprise
See all- CVE-2025-27225High
TRUfusion Enterprise through 7.10.4.0 exposes the /trufusionPortal/jsp/internal_admin_contact_login.jsp endpoint to unauthenticated users. This endpoint discloses sensitive internal information, including PII, to unauthenticated attackers.
- CVE-2025-27223High
TRUfusion Enterprise through 7.10.4.0 exposes the encrypted COOKIEID as an authentication mechanism for some endpoints such as /trufusionPortal/getProjectList. However, the application uses a static key to create the encrypted cookie, ultimately allowing anyone to forge cookies and gain access to sensitive internal information.
- CVE-2025-27222High
TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/getCobrandingData endpoint to retrieve files. However, the application doesn't properly sanitize the input to this endpoint, ultimately allowing path traversal sequences to be included. This can be used to read any local server file that is accessible by the TRUfusion user and can also be used to leak cleartext passwords of TRUfusion Enterprise itself.
Original NVD description (English source)
TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/fileupload endpoint to upload files. However, the application doesn't properly sanitize the input to this endpoint, ultimately allowing path traversal sequences to be included. This can be used to write to any filename with any file type at any location on the local server, ultimately allowing execution of arbitrary code.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS