CVE-2025-27222

TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/getCobrandingData endpoint to retrieve files. However, the application doesn't properly sanitize the input to this endpoint, ultimately allowing path traversal sequences to be included. This can be used to read any local server file...

EUVD-2025-36215

TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/getCobrandingData endpoint to retrieve files. However, the application doesn't properly sanitize the input to this endpoint, ultimately allowing path traversal sequences to be included. This can be used to read any local server file...

CVE-2025-27222

TRUfusion Enterprise versions up to and including 7.10.4.0 are vulnerable to a pre-auth path traversal vulnerability in the /trufusionPortal/getCobrandingData endpoint. The root cause is insufficient input sanitization, which allows attackers to include path traversal sequences to read arbitrary ...