CVE-2025-27222
HighCVSS 8.6Exploitation Probability (EPSS)
High risk81th percentile - higher than 81% of all known CVEs
Summary
TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/getCobrandingData endpoint to retrieve files. However, the application doesn't properly sanitize the input to this endpoint, ultimately allowing path traversal sequences to be included. This can be used to read any local server file that is accessible by the TRUfusion user and can also be used to leak cleartext passwords of TRUfusion Enterprise itself.
Risk Assessment
An attacker can read arbitrary server files, including configuration files with cleartext passwords, potentially leading to full system compromise. The risk includes data leakage and privilege escalation.
Recommendation
Update TRUfusion Enterprise to a version newer than 7.10.4.0 if available, and restrict access to the /trufusionPortal/getCobrandingData endpoint to trusted networks.
Other vulnerabilities in TRUfusion Enterprise
See all- CVE-2025-27225High
TRUfusion Enterprise through 7.10.4.0 exposes the /trufusionPortal/jsp/internal_admin_contact_login.jsp endpoint to unauthenticated users. This endpoint discloses sensitive internal information, including PII, to unauthenticated attackers.
- CVE-2025-27224Critical
TRUfusion Enterprise through 7.10.4.0 does not properly sanitize input to the /trufusionPortal/fileupload endpoint, allowing path traversal sequences. This enables writing files with any filename and type to any location on the local server, ultimately leading to arbitrary code execution.
- CVE-2025-27223High
TRUfusion Enterprise through 7.10.4.0 exposes the encrypted COOKIEID as an authentication mechanism for some endpoints such as /trufusionPortal/getProjectList. However, the application uses a static key to create the encrypted cookie, ultimately allowing anyone to forge cookies and gain access to sensitive internal information.
Original NVD description (English source)
TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/getCobrandingData endpoint to retrieve files. However, the application doesn't properly sanitize the input to this endpoint, ultimately allowing path traversal sequences to be included. This can be used to read any local server file that is accessible by the TRUfusion user and can also be used to leak cleartext passwords of TRUfusion Enterprise itself.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS