How severe is CVE-2025-59793?

CVE-2025-59793 has a CVSS 3.x base score of 9.9, rated critical severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2025-59793 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (59th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-59793?

CVE-2025-59793 affects Rocketsoftware Trufusion Enterprise. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-59793?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2025-59793 have an EU (EUVD) identifier?

Yes. CVE-2025-59793 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-207696.

When was CVE-2025-59793 published?

CVE-2025-59793 was published on 2026-02-17 and last updated on 2026-06-17.

CVE-2025-59793

CVE-2025-59793 is a critical-severity vulnerability in Rocketsoftware Trufusion Enterprise with a CVSS 3.x base score of 9.9. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-35.

Key facts

Severity: Critical (CVSS 3.x base score 9.9)
CVSS v4: 9.4
EPSS exploit prediction: 1% (59th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-207696
Weakness: CWE-35
Affected product: Rocketsoftware Trufusion Enterprise
Published: 2026-02-17
Last modified: 2026-06-17

Description

Rocket TRUfusion Enterprise through 7.10.5 exposes the endpoint at /axis2/services/WsPortalV6UpDwAxis2Impl to authenticated users to be able to upload files. However, the application doesn't properly sanitize the jobDirectory parameter, which allows path traversal sequences to be included. This allows writing files to arbitrary local filesystem locations and may subsequently lead to remote code execution.

Frequently asked questions

What is CVE-2025-59793?: Rocket TRUfusion Enterprise through 7.10.5 exposes the endpoint at /axis2/services/WsPortalV6UpDwAxis2Impl to authenticated users to be able to upload files. However, the application doesn't properly sanitize the jobDirectory parameter, which allows path traversal sequences to be included. This allows writing files to arbitrary local filesystem locations and may subsequently lead to remote code execution.
How severe is CVE-2025-59793?: CVE-2025-59793 has a CVSS 3.x base score of 9.9, rated critical severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2025-59793 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (59th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-59793?: CVE-2025-59793 affects Rocketsoftware Trufusion Enterprise. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-59793?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2025-59793 have an EU (EUVD) identifier?: Yes. CVE-2025-59793 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-207696.
When was CVE-2025-59793 published?: CVE-2025-59793 was published on 2026-02-17 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:rocketsoftware:trufusion_enterprise:*:*:*:*:*:*:*:*

More vulnerabilities in Rocketsoftware Trufusion Enterprise

CVE-2025-27224 — Critical (CVSS 9.8): TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/fileupload endpoint to upload files. However, the…
CVE-2025-27222 — High (CVSS 8.6): TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/getCobrandingData endpoint to retrieve files. However,…
CVE-2025-27225 — High (CVSS 7.5): TRUfusion Enterprise through 7.10.4.0 exposes the /trufusionPortal/jsp/internal_admin_contact_login.jsp endpoint to…
CVE-2025-27223 — High (CVSS 7.5): TRUfusion Enterprise through 7.10.4.0 exposes the encrypted COOKIEID as an authentication mechanism for some endpoints…
CVE-2022-25027 — High (CVSS 7.5): The Forgotten Password functionality of Rocket TRUfusion Portal v7.9.2.1 allows remote attackers to bypass…
CVE-2022-25026 — High (CVSS 7.5): A Server-Side Request Forgery (SSRF) in Rocket TRUfusion Portal v7.9.2.1 allows remote attackers to gain access to…

All CVEs affecting Rocketsoftware Trufusion Enterprise →

Other CWE-35 vulnerabilities

CVE-2026-6074 — Critical (CVSS 9.8): Intrado 911 Emergency Gateway (EGW) 5.x, 6.x, and 7.x contain a path traversal vulnerability in the…
CVE-2025-41723 — Critical (CVSS 9.8): The importFile SOAP method is vulnerable to a directory traversal attack. An unauthenticated remote attacker bypass the…
CVE-2025-42937 — Critical (CVSS 9.8): SAP Print Service (SAPSprint) performs insufficient validation of path information provided by users. An…
CVE-2025-30515 — Critical (CVSS 9.8): CyberData 011209 Intercom could allow an authenticated attacker to upload arbitrary files to multiple locations…
CVE-2026-52703 — Critical (CVSS 9.6): Unauthenticated Path Traversal in FastDup <= 2.7.2 versions.
CVE-2025-53417 — Critical (CVSS 9.3): DIAView (v4.2.0 and prior) - Directory Traversal Information Disclosure Vulnerability

Browse all CWE-35 vulnerabilities →