Vulnerability · Published Feb 3, 2026 · Assigned by mitre
CVE-2025-69981
High 7.5
In plain English
A high-severity unrestricted file upload in the fuxa-server package (npm). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).
Official description
FUXA v1.2.7 contains an Unrestricted File Upload vulnerability in the `/api/upload` API endpoint. The endpoint lacks authentication mechanisms, allowing unauthenticated remote attackers to upload arbitrary files. This can be exploited to overwrite critical system files (such as the SQLite user database) to gain administrative access, or to upload malicious scripts to execute arbitrary code.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | fuxa-server | no fix listed | GHSA-7g56-fwxj-cm23 |
Affected products (as reported)
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N