CVE-2025-27222
HIGH EXPLOITED NUCLEITRUfusion Enterprise <= 7.10.4.0 - Path Traversal
Title source: nucleiDescription
TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/getCobrandingData endpoint to retrieve files. However, the application doesn't properly sanitize the input to this endpoint, ultimately allowing path traversal sequences to be included. This can be used to read any local server file that is accessible by the TRUfusion user and can also be used to leak cleartext passwords of TRUfusion Enterprise itself.
Nuclei Templates (1)
TRUfusion Enterprise <= 7.10.4.0 - Path Traversal
CRITICALVERIFIEDby DhiyaneshDK,rcesecurity
FOFA:
body="TRUfusion"
Scores
CVSS v3
8.6
EPSS
0.0512
EPSS Percentile
89.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Details
VulnCheck KEV
2026-03-07
CWE
CWE-22
CWE-35
Status
published
Products (1)
rocketsoftware/trufusion_enterprise
< 7.10.4.0
Published
Oct 27, 2025
Tracked Since
Feb 18, 2026