CVE-2025-27222

TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/getCobrandingData endpoint to retrieve files. However, the application doesn't properly sanitize the input to this endpoint, ultimately allowing path traversal sequences to be included. This can be used to read any local server file...

EUVD-2025-36215

TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/getCobrandingData endpoint to retrieve files. However, the application doesn't properly sanitize the input to this endpoint, ultimately allowing path traversal sequences to be included. This can be used to read any local server file...

CVE-2025-27222

TRUfusion Enterprise ≤ 7.10.4.0 is impacted by a pre-auth path-traversal in the /trufusionPortal/getCobrandingData endpoint. The unsanitized input can cause the traversal sequences to be processed, allowing an unauthenticated attacker to read arbitrary local files accessible to the TRUfusion user...