/Vulnerability Library

FUXA <= 1.2.9 - Unauthenticated Path Traversal to Arbitrary File Write

CVE-2026-25895
Verified

Description

FUXA, an open-source Node.js SCADA/HMI web interface, through version 1.2.9 exposes an unauthenticated POST /api/upload endpoint that resolves the attacker-controlled `destination` field from the JSON request body against the application directory with only a leading underscore prefix and no containment check. Because path.resolve() honours "../" segments, an unauthenticated attacker can escape the application directory and write arbitrary files anywhere on the filesystem reachable by the service account - for example into the public web root (a/../../client/dist), into cron directories, or over SSH authorized_keys - leading to remote code execution. Version 1.2.10 rejects any destination containing a traversal segment and additionally requires an authenticated administrator.

Severity

Critical

CVSS Score

9.8

Exploit Probability

13%

Affected Product

fuxa

Published Date

August 3, 2026

Template Author

prithvee07

CVE-2026-25895.yaml
9.8Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2026-25895
CWE ID:
cwe-22

References

https://github.com/frangoteam/FUXA/security/advisories/GHSA-88qh-cphv-996chttps://github.com/frangoteam/FUXA/commit/22c2192f5d9beef8a787c45eff3a14c24dbb5f96https://github.com/frangoteam/FUXA/releases/tag/v1.2.10https://github.com/Hann1bl3L3ct3r/FUXAPWNhttps://nvd.nist.gov/vuln/detail/CVE-2026-25895

Remediation Steps

Upgrade FUXA to version 1.2.10 or later, which validates and contains the `destination` parameter to the intended application directory and requires administrator authentication on /api/upload.