Sign in
Deutsch English Español Polski
Critical

FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API

  • Disclosed: 05.02.2026
  • Updated: 11.10.2026 10:22

Summary

Description A path traversal vulnerability in FUXA allows an unauthenticated, remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10.

Impact

This affects all deployments, including those with runtime.settings.secureEnabled set to true.

Exploitation allows an unauthenticated, remote attacker to overwrite application and system files. If the attacker can overwrite application code, startup scripts, or configuration files that are later executed/loaded, RCE is likely. Depending on deployment configuration and permissions, this may lead to full system compromise and could further expose connected ICS/SCADA environments to follow-on actions.

Patches

This issue has been patched in FUXA version 1.2.10. Users are strongly encouraged to update to the latest available release.

Notes

GitHub stated this vulnerability is identical to CVE-2025-69981, which was published against the repository out of band before coordinated disclosure concluded. CVE-2025-69981 describes a "CWE-434: Unrestricted Upload of File with Dangerous Type" vulnerability. While a CWE-434 is present, it was an unsafe, intended feature of the application that has been locked behind authentication. This report describes a "CWE-35: Path Traversal" that enables an arbitrary file write.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
npm package fuxa-server < 1.2.10 1.2.10

References

CVSS score -
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Weakness (CWE)
CWE-22, CWE-306
Platform
npm
Package
fuxa-server
Disclosed
05.02.2026
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-88qh-cphv-996c - CC BY 4.0

Vulnerability history: fuxa-server

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (21) in the archive
Total entries
21
First → latest
09.2023 06.2026
Without a fix
9
Exploited in attacks
0

Severity breakdown

  • Critical 8
  • High 10
  • Medium 3

Disclosures per year

Severity:
  1. FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response reading
    High · 8.2 CVE-2026-47719 <= 1.1.14-1243 no fix
  2. FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations
    High · 7.5 CVE-2026-47717 >= 1.3.0, < 1.3.1 1.3.1
  3. FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass
    High CVE-2026-43947 >= 1.3.0, < 1.3.1 1.3.1
  4. FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue
    High CVE-2026-43946 >= 1.3.0, < 1.3.1 1.3.1
  5. FUXA Affected by a Path Traversal Sanitization Bypass
    High CVE-2026-25951 < 1.2.11 1.2.11
  6. FUXA Unauthenticated Remote Arbitrary Scheduler Write
    Critical CVE-2026-25939 >= 1.2.8, < 1.2.11 1.2.11
  7. FUXA Unauthenticated Remote Code Execution in Node-RED Integration
    Critical CVE-2026-25938 >= 1.2.8, < 1.2.11 1.2.11
  8. FUXA Unauthenticated Remote Arbitrary Device Tag Write
    Critical CVE-2026-25752 < 1.2.10 1.2.10
  9. FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API this entry
    Critical CVE-2026-25895 < 1.2.10 1.2.10
  10. FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration
    Critical CVE-2026-25894 < 1.2.10 1.2.10
  11. FUXA Unauthenticated Exposure of Plaintext Database Credentials
    Critical CVE-2026-25751 < 1.2.10 1.2.10
  12. FUXA Unauthenticated Remote Code Execution via Admin JWT Minting
    Critical CVE-2026-25893 < 1.2.10 1.2.10
  13. FUXA allows Remote Code Execution (RCE) via the project import functionality.
    High · 9.8 CVE-2025-69983 <= 1.2.7 no fix
  14. FUXA contains an Unrestricted File Upload vulnerability
    High CVE-2025-69981 <= 1.2.7 no fix
  15. FUXA contains an insecure default configuration vulnerability
    High CVE-2025-69970 <= 1.2.7 no fix
  16. FUXA SQL Injection vulnerability
    Critical · 9.8 CVE-2023-31719 <= 1.1.12 no fix
  17. FUXA local file inclusion vulnerability
    High · 7.5 CVE-2023-31718 <= 1.1.12 no fix
  18. FUXA SQL Injection vulnerability
    High · 7.5 CVE-2023-31717 <= 1.1.12 no fix

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.