CVE-2026-25895
CVE-2026-25895 · FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API
This page contains facts from public vulnerability sources. Check the original advisory before updating.
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. A path traversal vulnerability in FUXA allows an unauthenticated, remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10.
CVSS 9.5 · Critical · EPSS 13.0% · Public exploit · Fix available
- Published
- Updated
Stack: node
Affected products and versions
fuxa
- Versions
- < 1.2.10: Affected
No fix published
fuxa-server npm
- Affected ranges
- SEMVER: < 1.2.10
Update to 1.2.10