CVE-2025-69981: FUXA Unrestricted File Upload via Unauthenticated /api/upload Endpoint

Overview

CVE-2025-69981 describes an unrestricted file upload weakness in the /api/upload endpoint of FUXA version 1.2.7, a product listed under Frangoteam Fuxa. The CNA description states that the endpoint has no authentication, so the weakness is described as reachable without credentials. The affected code location is referenced in the GitHub source file.

Impact

According to the record, an unauthenticated remote attacker could upload arbitrary files. The description says this could be used to overwrite critical files such as the SQLite user database to gain administrative access, or to upload scripts that execute arbitrary code.

NVD assigns a CVSS 3.1 base score of 9.8 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which reflects high impact to confidentiality, integrity and availability. The record also contains a second CVSS 3.1 score of 7.5 from a provider that is not identified.

Affected products and versions

• Product listed: Frangoteam Fuxa, version 1.2.7.
• The record lists no other affected versions and no fixed versions.
• Whether other versions are affected is unknown from the sources consulted.

Exploitation status

The record shows that this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. No confirmed exploitation appears in the sources consulted. No EPSS data is available in the record.

Remediation and mitigation

• No fixed version is listed in the record. The absence of a fix in this data does not mean none exists, so check the official FUXA project repository and vendor channels for updates.
• Until a fix is verified, limit network exposure of FUXA instances, especially access to the upload function, and avoid exposing them to untrusted networks.
• Place authentication in front of the upload functionality through network controls or a reverse proxy as an interim measure, and confirm how the application enforces access.
• Restrict the permissions of the account running FUXA, keep uploaded content separate from executable paths, and keep database files outside directories that accept uploads.
• If an exposed instance was reachable by untrusted parties, review user accounts and recent file changes as part of incident response.

Detection guidance

• Review web server and application logs for requests to /api/upload from unexpected sources or without a valid session context.
• Monitor for newly created or modified files in FUXA directories, and for unexpected changes to the SQLite database or user records.
• Alert on the creation of script files in locations the application serves or executes.

These are high-level indicators; validate them in a test environment before relying on them.

Limitations of the available information

• The record provides one GitHub code reference and the NVD and CVE.org pages. It does not include a vendor advisory, patch note or technical validation details.
• Fixed versions, exploitation evidence beyond the KEV status, and the source of the 7.5 score are unknown.
• Exact file paths, database location and upload handling details are not confirmed by the record.

Frequently asked questions

Is CVE-2025-69981 known to be actively exploited?

The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

Which version is affected?

The record lists Frangoteam Fuxa version 1.2.7. Other versions are not confirmed by the available data.

Is a fixed version available?

No fixed version is listed in the record. Check the official FUXA repository and restrict access to the upload endpoint in the meantime.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.