CVE-2026-25895
published 2026-02-09CVE-2026-25895: FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. A path traversal vulnerability in FUXA allows an unauthenticated, remote attacker to…
PriorityP277critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
2.67%
83.9th percentile
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. A path traversal vulnerability in FUXA allows an unauthenticated, remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| frangoteam | fuxa | < 1.2.10 | 1.2.10 |
Detection & IOCsextracted from sources · hover to see the quote
- ·The vulnerability affects FUXA through version 1.2.9; version 1.2.10 contains the patch. Verify the deployed version via GET /api/version before assuming patched status. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.09.5CRITICALCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
ghsa9.8CRITICAL
osv9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API
ghsa·2026-02-05·CVSS 9.8
CVE-2026-25895 [CRITICAL] CWE-22 FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API
FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API
### Summary
**Description**
A path traversal vulnerability in FUXA allows an unauthenticated, remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10.
### Impact
This affects all deployments, including those with `runtime.settings.secureEnabled` set to `true`.
Exploitation allows an unauthenticated, remote attacker to overwrite application and system files. If the attacker can overwrite application code, startup scripts, or configuration files that are later executed/loaded, RCE is likely. Depending on deployment configuration and permissions, this may lead to full system compromise
OSV
FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API
osv·2026-02-05·CVSS 9.8
CVE-2026-25895 [CRITICAL] FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API
FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API
### Summary
**Description**
A path traversal vulnerability in FUXA allows an unauthenticated, remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10.
### Impact
This affects all deployments, including those with `runtime.settings.secureEnabled` set to `true`.
Exploitation allows an unauthenticated, remote attacker to overwrite application and system files. If the attacker can overwrite application code, startup scripts, or configuration files that are later executed/loaded, RCE is likely. Depending on deployment configuration and permissions, this may lead to full system compromise
No detection rules found.
2026-02-09
Published