CVE-2025-32355

HIGHNuclei

rocketsoftware trufusion_enterprise Server-Side Request Forgery (SSRF)

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2025-32355 has a selected CVSS score of 7.9 (high); EIP currently links 1 Nuclei template.

Description

Rocket TRUfusion Enterprise through 7.10.4.0 uses a reverse proxy to handle incoming connections. However, the proxy is misconfigured in a way that allows specifying absolute URLs in the HTTP request line, causing the proxy to load the given resource.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Mar 31, 2026 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 24, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

TRUfusion Enterprise

Browse Rocket Software / TRUfusion Enterprise
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryHIGHRocket TRUfusion Enterprise - Server Side Request Forgery

Rocket TRUfusion Enterprise through 7.10.4.0 uses a reverse proxy to handle incoming connections. However, the proxy is misconfigured in a way that allows specifying absolute URLs in the HTTP request line, causing the proxy to load the given resource.

Impact

Attackers can make the proxy load arbitrary resources, potentially leading to information disclosure or further attacks.

Remediation

Update to the latest version with proxy configuration fixes.

Authorsprincechaddha, rcesecurity, DhiyaneshDk
Template tagscvecve2025rockettrufusionssrfvkev
Shodan: html:"TRUfusion Enterprise"
https://www.rcesecurity.com/2026/02/when-audits-fail-from-pre-auth-ssrf-to-rce-in-trufusion-enterprise/ https://nvd.nist.gov/vuln/detail/CVE-2025-32355

Source: ProjectDiscovery

References

4