CVE-2026-25951 FUXA has a Path Traversal Sanitization Bypass
An authenticated administrator can bypass path sanitization to write arbitrary files, leading to remote code execution in FUXA SCADA software.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-25951?
CVE-2026-25951 is a high-severity path traversal vulnerability in frangoteam FUXA, published on 9 Feb 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.2.11, there is a flaw in the path sanitization logic allows an authenticated attacker with administrative privileges to bypass directory traversal protections. By using nested traversal sequences (e.g., ....//), an attacker can write arbitrary files to the server filesystem, including sensitive directories like runtime/scripts. This leads to Remote Code Execution (RCE) when the server reloads the malicious scripts. This vulnerability is fixed in 1.2.11.
Which versions are affected by CVE-2026-25951?
2 open source packages ship an affected version, including fuxa-server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
fuxa-server npm | All versions | 1.2.11 |
fuxa-server npm | All versions | 1.2.11 |
Products include Frangoteam Fuxa.
How do I fix CVE-2026-25951?
Upgrade fuxa-server to 1.2.11 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-25951 being exploited?
There is no known exploitation of CVE-2026-25951 in the wild and no public exploit code.
Other vulnerabilities in frangoteam FUXA
- CVE-2026-25893 FUXA Unauthenticated Remote Code Execution via Admin JWT Minting
- CVE-2025-69985 FUXA has JWT Authentication Bypass via HTTP Referer header spoofing
- CVE-2025-69971 FUXA has a hardcoded fallback JWT signing secret
- CVE-2023-31719 FUXA SQL Injection vulnerability
- CVE-2023-33831 A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA
Sources
Also known as GHSA-68m5-5w2h-h837.