CVE-2025-27224: Path Traversal
TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/fileupload endpoint to upload files. However, the application doesn't properly sanitize the input to this endpoint, ultimately allowing path traversal sequences to be included. This can be used to write to any filename with any file type at any location on the local server, ultimately allowing execution of arbitrary code.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27224?
CVE-2025-27224 is considered to have a high severity due to its potential for exploitation through path traversal vulnerabilities.
How do I fix CVE-2025-27224?
To fix CVE-2025-27224, ensure proper input validation and sanitization for the /trufusionPortal/fileupload endpoint in TRUfusion Enterprise.
Who is affected by CVE-2025-27224?
CVE-2025-27224 affects TRUfusion Enterprise versions up to and including 7.10.4.0.
What is the vulnerability type of CVE-2025-27224?
CVE-2025-27224 is classified as a path traversal vulnerability that allows unauthorized file uploads.
Can CVE-2025-27224 lead to remote code execution?
Yes, exploiting CVE-2025-27224 may allow an attacker to write arbitrary files, potentially leading to remote code execution.