CVE-2025-59793

The record

Rocket TRUfusion Enterprise through 7.10.5 exposes the endpoint at /axis2/services/WsPortalV6UpDwAxis2Impl to authenticated users to be able to upload files. However, the application doesn't properly sanitize the jobDirectory parameter, which allows path traversal sequences to be included. This allows writing files to arbitrary local filesystem locations and may subsequently lead to remote code execution.

Affected packages

Related vulnerabilities

• CVE-2026-85310 import_contacts Path Traversal in Groundhogg <= 4.7.1 versions. CWE-35
• CVE-2026-21103 Path traversal in GalaxyDiagnostics prior to SMR Sep-2026 Release 1 allows physical… CWE-35
• CVE-2026-21092 Path traversal in ImsService prior to SMR Sep-2026 Release 1 allows remote attackers to… CWE-35
• CVE-2026-20513 In Audio HAL, there is a possible information disclosure due to improper input validation. CWE-35
• CVE-2026-59909 Dell ObjectScale, versions prior to 4.3.0.1, contain(s) a Path Traversal vulnerability. CWE-35
• CVE-2026-56089 Dell ObjectScale, versions prior to 4.3.0.1, contain(s) a Path Traversal vulnerability. CWE-35
• CVE-2026-28157 Subscriber Path Traversal in Do Lasso <= 358 versions. CWE-35
• CVE-2026-69109 A vulnerability has been identified in Siemens License Server (SLS) (All versions < V5.3). CWE-35