Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.4
CVE-2025-59793: Rocket TRUfusion Enterprise allows authenticated users to upload files to arbitrary locations
CVE-2025-59793 · published 8 months ago
Summary
The Rocket TRUfusion Enterprise software allows authenticated users to upload files to any location on the system, which could allow hackers to install malicious code. This is a serious security risk because it could let hackers take control of your system. To mitigate this issue, Rocket should be patched to the latest version.
Original advisory text
Rocket TRUfusion Enterprise through 7.10.5 exposes the endpoint at /axis2/services/WsPortalV6UpDwAxis2Impl to authenticated users to be able to upload files. However, the application doesn't proper...
Rocket TRUfusion Enterprise through 7.10.5 exposes the endpoint at /axis2/services/WsPortalV6UpDwAxis2Impl to authenticated users to be able to upload files. However, the application doesn't properly sanitize the jobDirectory parameter, which allows path traversal sequences to be included. This allows writing files to arbitrary local filesystem locations and may subsequently lead to remote code execution.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.4
Critical
Type
CWE-35Path Traversal: '.../...//'
Timeline
Published17 Feb 2026
Updated4 Nov 2026
First seen6 Mar 2026
Sources
CVE-2025-59793 · NVD
Track software like this
Free during beta