PT-2026-8388 · Unknown · Rocket Trufusion Enterprise

Published 2026-02-16 · Updated 2026-03-23 · CVE-2025-59793

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rocket TRUfusion Enterprise versions through 7.10.5

Description Rocket TRUfusion Enterprise through version 7.10.5 exposes the /axis2/services/WsPortalV6UpDwAxis2Impl endpoint to authenticated users, allowing file uploads. The application does not properly sanitize the jobDirectory parameter, enabling the inclusion of path traversal sequences. This allows writing files to arbitrary local filesystem locations, potentially leading to remote code execution. The vulnerability can be chained with the default password 'trubiquity' and exploited through Server-Side Request Forgery (SSRF) to reach internal applications, such as Keycloak instances.

Recommendations Versions prior to 7.10.5 are affected.

Exploit

Fix

RCE

Weakness Enumeration

CWE-35

Related Identifiers

CVE-2025-59793

Affected Products

Rocket Trufusion Enterprise

References · 17

• 🔥 https://rcesecurity.com/advisories/cve-2025-59793 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-59793 · Security Note
• https://rcesecurity.com · Note
• https://t.me/CVEtracker/44893 · Telegram Post
• https://twitter.com/rcesecurity/status/2023658654604431544 · Twitter Post
• https://twitter.com/ksg93rd/status/2023791920942608810 · Twitter Post
• https://t.me/cveNotify/155111 · Telegram Post
• https://reddit.com/r/CVEWatch/comments/1r80265/top_10_trending_cves_18022026 · Reddit Post
• https://rocketsoftware.com/en-us/products/b2b-supply-chain-integration/trufusion · Note
• https://twitter.com/MrTuxracer/status/2023793156068647265 · Twitter Post
• https://twitter.com/infoflowcloud/status/2036025554680348837 · Twitter Post
• https://rocketsoftware.com/products/rocket-b2b-supply-chain-integration/rocket-trufusion-enterprise · Note
• https://reddit.com/r/CVEWatch/comments/1r8wba2/top_10_trending_cves_19022026 · Reddit Post
• https://twitter.com/VulmonFeeds/status/2023874895352906192 · Twitter Post
• https://t.me/secharvester/21434 · Telegram Post