CVE-2025-59793: Path Traversal
Rocket TRUfusion Enterprise through 7.10.5 exposes the endpoint at /axis2/services/WsPortalV6UpDwAxis2Impl to authenticated users to be able to upload files. However, the application doesn't properly sanitize the jobDirectory parameter, which allows path traversal sequences to be included. This allows writing files to arbitrary local filesystem locations and may subsequently lead to remote code execution.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59793?
CVE-2025-59793 has a high severity rating due to its potential for path traversal attacks.
How do I fix CVE-2025-59793?
Fix CVE-2025-59793 by upgrading Rocket TRUfusion Enterprise to a version higher than 7.10.5 and ensuring proper input validation for the jobDirectory parameter.
What impact does CVE-2025-59793 have on systems?
CVE-2025-59793 allows authenticated users to upload files improperly, potentially leading to unauthorized file access or execution.
Is CVE-2025-59793 exploitable in all configurations?
CVE-2025-59793 is exploitable in configurations of Rocket TRUfusion Enterprise that are using versions up to and including 7.10.5.
Who is affected by CVE-2025-59793?
Organizations using Rocket TRUfusion Enterprise versions 7.10.5 and earlier are affected by CVE-2025-59793.