🛡️ CVE-2025-59793 — trufusion-enterprise

How this vulnerability can be exploited

This issue can be reached over the network, attack complexity is low, an attacker needs low-level privileges on the target. No user interaction is required. The scope is changed, meaning a successful attack can affect components beyond the vulnerable one. Rated impact: confidentiality high, integrity high, availability high.

CVSS metrics in full

The score comes from this vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

• Attack vector: Network — reachable from anywhere that can route to the service.
• Attack complexity: Low — the attack works reliably, with no preparation.
• Privileges required: Low — an ordinary user account is enough.
• User interaction: None — nobody has to be tricked into anything.
• Scope: Changed — a successful attack reaches components beyond the vulnerable one.
• Confidentiality impact: High — total loss, or loss the attacker controls.
• Integrity impact: High — total loss, or loss the attacker controls.
• Availability impact: High — total loss, or loss the attacker controls.

Weakness class

CVE-2025-59793 is classified as CWE-35: Path Traversal: '.../...//'. The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory.

Affected software

CVE-2025-59793 is recorded against 1 package.

• trufusion-enterprise (fixed in 7.10.5.0)

Timeline and source

Published on 17 February 2026 and last revised on 17 June 2026. A public exploit is known to exist, which raises the urgency of patching considerably. Record sourced from NVD.

References

www.rcesecurity.com
www.rcesecurity.com
www.rocketsoftware.com
www.rocketsoftware.com

Other advisories for this package

trufusion-enterprise has other advisories on record. If you are patching this one, these are worth checking on the same host:

• CVE-2025-32355 (7.3 High, published 17 Feb 2026)
• CVE-2025-27224 (9.8 Critical, published 27 Oct 2025)
• CVE-2025-27223 (7.5 High, published 27 Oct 2025)
• CVE-2025-27222 (8.6 High, published 27 Oct 2025)
• CVE-2025-27225 (7.5 High, published 27 Oct 2025)
• CVE-2022-25027 (7.5 High, published 12 Jan 2023)
• CVE-2022-25026 (7.5 High, published 12 Jan 2023)

Same weakness in other software

These advisories are the same class of weakness (CWE-35: Path Traversal: '.../...//') in other software:

• CVE-2026-59115 (9.9 Critical, published 7 Aug 2026)
• CVE-2026-66695 (6.5 Medium, published 6 Aug 2026)
• CVE-2025-59181 (published 27 Jul 2026)
• CVE-2025-60835 (7.8 High, published 22 Jul 2026)
• CVE-2026-49779 (6.5 Medium, published 2 Jul 2026)
• CVE-2026-7302 (9.5 Critical, published 29 Jun 2026)
• CVE-2026-42274 (8.0 High, published 25 Jun 2026)
• GHSA-phv5-334h-mxcw (9.5 Critical, published 23 Jun 2026)

Details

Affected Packages

References