Vulnerability · Published Feb 9, 2026 · Assigned by GitHub_M

CVE-2026-25895FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API

Critical 9.5

In plain English

A critical-severity path traversal in FUXA from frangoteam. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 12.8% (higher than 96% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)9.5Critical

Exploit odds (30 days)12.8%top 3.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling2Nuclei, Public PoC

Official description

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. A path traversal vulnerability in FUXA allows an unauthenticated, remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	fuxa-server	1.2.10	GHSA-88qh-cphv-996c

Affected products (as reported)

Vendor	Product	Versions
frangoteam	FUXA	< 1.2.10

Weakness: CWE-22, CWE-306 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

https://github.com/frangoteam/FUXA/security/advisories/GHSA-88qh-cphv-996c x_refsource_CONFIRM
https://github.com/frangoteam/FUXA/commit/22c2192f5d9beef8a787c45eff3a14c24dbb5f96 x_refsource_MISC
https://github.com/frangoteam/FUXA/releases/tag/v1.2.10 x_refsource_MISC