CVE-2026-25895 FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API

What is CVE-2026-25895?

CVE-2026-25895 is a critical path traversal vulnerability in frangoteam FUXA, published on 9 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. A path traversal vulnerability in FUXA allows an unauthenticated, remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10.

Weakness: CWE-306, CWE-22

Which versions are affected by CVE-2026-25895?

2 open source packages ship an affected version, including fuxa-server. It affects 1 product.

Products include Frangoteam Fuxa.

How do I fix CVE-2026-25895?

Upgrade fuxa-server to 1.2.10 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-25895 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-25895 exists.

Public exploit code: 1 Exploit-DB entry, 1 Nuclei template and 1 proofs of concept on GitHub.

Other vulnerabilities in frangoteam FUXA

• CVE-2026-25893 FUXA Unauthenticated Remote Code Execution via Admin JWT Minting Critical 10.0
• CVE-2025-69985 FUXA has JWT Authentication Bypass via HTTP Referer header spoofing Critical 9.8
• CVE-2025-69971 FUXA has a hardcoded fallback JWT signing secret Critical 9.8
• CVE-2023-31719 FUXA SQL Injection vulnerability Critical 9.8
• CVE-2023-33831 A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-88qh-cphv-996c.