CVE-2025-27222

🗓️ 27 Oct 2025 00:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 63 Views🌐 WEB

CVE-2025-27222: Path traversal in TRUfusion Enterprise 7.10.4.0 reads local files and leaks passwords.

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2025-27222	30 Sep 202515:43	–	circl
CNNVD	Rocket TRUfusion Enterprise security vulnerabilities	27 Oct 202500:00	–	cnnvd
Cvelist	CVE-2025-27222	27 Oct 202500:00	–	cvelist
EUVD	EUVD-2025-36215	27 Oct 202500:00	–	euvd
Nuclei	TRUfusion Enterprise <= 7.10.4.0 - Path Traversal	9 Mar 202605:27	–	nuclei
NVD	CVE-2025-27222	27 Oct 202517:15	–	nvd
osv_cve	CVE-2025-27222	27 Oct 202517:15	–	osv_cve
Positive Technologies	PT-2025-40524	3 Oct 202500:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2025-27222: Improper Limitation of a Pathname to a Restricted Directory	27 Oct 202500:00	–	rapid7
RedhatCVE	CVE-2025-27222	28 Oct 202500:27	–	redhatcve

NVD

Node

Source	Link
github	www.github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2025-27222.txt
rocketsoftware	www.rocketsoftware.com/products/rocket-b2b-supply-chain-integration/rocket-trufusion-enterprise
rcesecurity	www.rcesecurity.com/2025/09/when-audits-fail-four-critical-pre-auth-vulnerabilities-in-trufusion-enterprise/

Parameter	Position	Path	Description	CWE
path traversal sequences	path	/trufusionPortal/getCobrandingData	Path traversal vulnerability in the /trufusionPortal/getCobrandingData endpoint allows an attacker to read arbitrary local files on the server, including cleartext passwords.	CWE-22, CWE-35

17 Jun 2026 09:03Current

5.5Medium risk

Vulners AI Score5.5

CVSS 3.18.6

EPSS0.02001

SSVC