PT-2026-8388 · Unknown · Rocket Trufusion Enterprise

Published 2026-02-16 · Updated 2026-02-17 · CVE-2025-59793

Positive Technologies · (AI Summary)

Name of the Vulnerable Software and Affected Versions Rocket TRUfusion Enterprise versions through 7.10.5

Description The software exposes the ''/axis2/services/WsPortalV6UpDwAxis2Impl'' endpoint to authenticated users, allowing file uploads. The application does not properly sanitize the

jobDirectory

parameter, enabling path traversal sequences. This allows writing files to arbitrary local filesystem locations, potentially leading to remote code execution. A Server-Side Request Forgery (SSRF) can be chained with the default password and the path traversal to achieve pre-authentication remote code execution. The SSRF allows querying internal applications, such as a Keycloak instance, by specifying internal IP addresses or hostnames.

Recommendations Versions prior to 7.10.5 should be updated.

Related Identifiers

CVE-2025-59793

Affected Products

Rocket Trufusion Enterprise

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-59793 · Security Note
• https://t.me/secharvester/21434 · Telegram Post
• https://twitter.com/rcesecurity/status/2023658654604431544 · Twitter Post
• https://rocketsoftware.com/en-us/products/b2b-supply-chain-integration/trufusion · Note
• https://rcesecurity.com/advisories/cve-2025-59793 · Note
• https://rocketsoftware.com/products/rocket-b2b-supply-chain-integration/rocket-trufusion-enterprise · Note
• https://rcesecurity.com · Note
• https://twitter.com/ksg93rd/status/2023791920942608810 · Twitter Post
• https://twitter.com/MrTuxracer/status/2023793156068647265 · Twitter Post