CVE-2025-59793: Rocket TRUfusion Path Traversal Flaw

CVE-2025-59793 Overview

Rocket TRUfusion Enterprise through version 7.10.5 contains a critical path traversal vulnerability in its file upload functionality. The application exposes an endpoint at /axis2/services/WsPortalV6UpDwAxis2Impl that allows authenticated users to upload files. However, the application fails to properly sanitize the jobDirectory parameter, enabling attackers to include path traversal sequences (such as ../) in their requests. This allows malicious actors to write files to arbitrary locations on the local filesystem, potentially leading to remote code execution.

Critical Impact

Authenticated attackers can leverage this path traversal vulnerability to write malicious files to arbitrary filesystem locations, potentially achieving remote code execution on affected Rocket TRUfusion Enterprise servers.

Affected Products

• Rocket TRUfusion Enterprise through version 7.10.5
• Rocket B2B Supply Chain Integration platforms utilizing TRUfusion Enterprise

Discovery Timeline

• 2026-02-17 - CVE-2025-59793 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2025-59793

Vulnerability Analysis

This path traversal vulnerability exists in the Rocket TRUfusion Enterprise web services layer, specifically within the AXIS2-based file upload service. The vulnerable endpoint /axis2/services/WsPortalV6UpDwAxis2Impl is designed to handle file upload operations for authenticated users as part of the B2B supply chain integration workflow.

The core issue stems from insufficient input validation on the jobDirectory parameter. When processing file upload requests, the application constructs file paths by concatenating user-supplied directory values without properly sanitizing or validating the input for directory traversal sequences. This allows attackers to escape the intended upload directory and write files to any location on the filesystem where the application has write permissions.

Root Cause

The root cause of this vulnerability is improper input validation and missing input sanitization on the jobDirectory parameter within the file upload service. The application fails to implement proper path canonicalization or validation checks that would prevent path traversal sequences like ../ from being processed. Without these security controls, user-supplied input can manipulate the destination path for uploaded files, breaking out of the designated upload directory structure.

Attack Vector

An authenticated attacker can exploit this vulnerability by sending a crafted request to the /axis2/services/WsPortalV6UpDwAxis2Impl endpoint with a malicious jobDirectory parameter value containing path traversal sequences. By including multiple ../ sequences, the attacker can navigate up the directory tree and specify an arbitrary destination path for the uploaded file.

Once the attacker can write files to arbitrary locations, they can potentially achieve remote code execution by:

1. Uploading a malicious web shell to a web-accessible directory
2. Overwriting configuration files to alter application behavior
3. Placing executable files in locations where they will be automatically executed by system processes
4. Modifying startup scripts or scheduled task configurations

For detailed technical information, see the RCE Security Advisory.

Detection Methods for CVE-2025-59793

Indicators of Compromise

• HTTP requests to /axis2/services/WsPortalV6UpDwAxis2Impl containing path traversal patterns such as ../, ..%2f, or ..%5c in parameters
• Unexpected file creation in directories outside the normal TRUfusion upload paths
• Web shells or unauthorized executable files appearing in web-accessible directories
• Anomalous file write operations by the TRUfusion application process to system or configuration directories

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests containing path traversal sequences targeting the AXIS2 services endpoint
• Monitor HTTP request logs for suspicious patterns in the jobDirectory parameter and related upload parameters
• Deploy file integrity monitoring (FIM) on critical system directories to detect unauthorized file creation or modification
• Review application logs for failed or successful file upload operations with unusual destination paths

Monitoring Recommendations

• Enable detailed logging for all file upload operations in Rocket TRUfusion Enterprise
• Configure alerts for any file write operations outside of designated upload directories
• Monitor the TRUfusion application service account for unexpected filesystem access patterns
• Implement network-level monitoring to detect unusual outbound connections that may indicate post-exploitation activity

How to Mitigate CVE-2025-59793

Immediate Actions Required

• Restrict access to the /axis2/services/WsPortalV6UpDwAxis2Impl endpoint to only trusted internal networks and users who require file upload functionality
• Implement WAF rules to block requests containing path traversal sequences targeting TRUfusion endpoints
• Review and audit user accounts with access to the file upload functionality to ensure principle of least privilege
• Monitor systems for indicators of compromise and investigate any suspicious file operations

Patch Information

Organizations should contact Rocket Software for information about security patches addressing this vulnerability. Review the vendor documentation and apply any available updates that sanitize the jobDirectory parameter and prevent path traversal attacks.

Workarounds

• Implement network segmentation to restrict access to the TRUfusion Enterprise server to only authorized internal systems
• Deploy a reverse proxy or WAF in front of the application to filter requests containing path traversal patterns before they reach the vulnerable endpoint
• Disable or restrict the /axis2/services/WsPortalV6UpDwAxis2Impl endpoint if the file upload functionality is not required for business operations
• Apply filesystem-level controls to limit the directories where the TRUfusion application service account can write files

# Example WAF rule to block path traversal attempts (ModSecurity format)
SecRule ARGS "@rx (\.\.\/|\.\.\\|%2e%2e%2f|%2e%2e\/|\.\.%2f|%2e%2e%5c)" \
    "id:100001,phase:2,deny,status:403,log,msg:'Path traversal attempt detected targeting TRUfusion'"