CVE-2026-25895

FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. A path traversal vulnerability in FUXA allows an unauthenticated, remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10.

Affected

frangoteam · FUXA

CVSS v4.0 GITHUB

9.5 CRITICALCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v4.0 GitHub

9.5 CRITICALCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

6.92% chance of exploitation in the next 30 days, 94th percentile

Nuclei

critical · CWE-22

Published

2026-02-09

Updated

2026-02-11

Proof-of-concept exploits (1)

• Hann1bl3L3ct3r/FUXAPWN2★ · 2026-05-26

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-25895.yaml

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/52568

Security advisories

• frangoteam/FUXA/security/advisories/GHSA-88qh-cphv-996c
• advisories/GHSA-88qh-cphv-996c
• frangoteam/FUXA/commit/22c2192f5d9beef8a787c45eff3a14c24dbb5f96

References

• CVE Record
• NVD entry

Related

• CVE-2025-3248
• CVE-2026-11349
• CVE-2026-1492
• CVE-2026-1779
• CVE-2026-4056
• CVE-2026-4112