CVE-2025-27222highobserved exploitationCWE-22CWE-35

CVE-2025-27222

Published

Follow this CVE

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

78Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 8.6epss 2.0%
from disclosure to weapon376 days
Published on NVDOct 27
1st PoC+376d
VulnCheck+131d
TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/getCobrandingData endpoint to retrieve files. However, the application doesn't properly sanitize the input to this endpoint, ultimately allowing path traversal sequences to be included. This can be used to read any local server file that is accessible by the TRUfusion user and can also be used to leak cleartext passwords of TRUfusion Enterprise itself.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.