CVE-2025-69983: FUXA: Remote Code Execution via Project Import (CWE-94)
CVE-2025-69983 affects FUXA 1.2.7, where importing a project file can lead to remote code execution because user-supplied scripts are not properly sanitized or sandboxed. NVD rates it critical with a CVSS 3.1 base score of 9.8. No KEV listing or confirmed exploitation appears in the sources consulted.
Overview
CVE-2025-69983 is a code injection weakness (CWE-94) in Frangoteam FUXA version 1.2.7. According to the record, the project import functionality does not properly sanitize or sandbox user-supplied scripts contained in imported project files. A malicious project file could therefore cause the server to run system commands.
Impact
The record describes remote code execution leading to full system compromise. NVD assesses the vulnerability with a CVSS 3.1 base score of 9.8 and the vector indicates network attack vector, low complexity, no privileges and no user interaction, with high confidence, integrity and availability impact.
- Confidentiality, integrity and availability are all rated high in the NVD vector.
- A second score of 8.2 (CVSS 3.1) appears in the record from another, unnamed provider.
Affected Products and Versions
- Product: Frangoteam Fuxa.
- Affected version listed: 1.2.7.
- The record does not list other affected versions, so the range of vulnerable releases is unknown.
- The record lists no fixed version.
The primary reference is the FUXA repository file that handles projects: FUXA project API source.
Exploitation Status
The CISA KEV catalog does not list this CVE in the record, and no confirmed exploitation in the wild appears in the sources consulted. The EPSS score is not available in the record.
Remediation and Mitigation
- Check the FUXA project repository and vendor channels for an updated release that addresses this issue. The record does not identify one.
- Until a fix is confirmed, limit who can import project files and restrict the import function to trusted administrators.
- Do not expose the FUXA web interface directly to untrusted networks; place it behind network segmentation, VPN or access controls.
- Run the service with least privilege so that a compromised process has limited access to the host.
- Treat project files from external or unverified sources as untrusted and review them before import.
Detection Guidance
- Log and review project import events, including who performed them and from which address.
- Monitor the FUXA host for unexpected child processes, new network connections or changes to files and scheduled tasks originating from the application.
- Alert on imports performed outside normal maintenance windows.
Limitations of the Available Information
The record does not provide a fixed version, a vendor advisory, detailed technical conditions for exploitation, or a list of all affected versions. The CVSS scores come from NVD and one other provider, and the second provider is not named. No KEV, SSVC or EPSS data is available. Conclusions about the exposure of a specific deployment depend on local configuration that the record does not describe.
Frequently asked questions
What is CVE-2025-69983?
It is a code injection weakness (CWE-94) in Frangoteam FUXA 1.2.7. The project import function does not properly sanitize or sandbox user-supplied scripts, which the record says can lead to remote code execution.
How severe is it?
NVD rates it critical with a CVSS 3.1 base score of 9.8. The record also shows a score of 8.2 from another provider that is not named.
Is a fix available?
The record does not list any fixed version. Check the FUXA repository and vendor channels for an update, and restrict project imports until a fix is confirmed.
Is it being exploited?
The CVE is not listed in CISA KEV in the record, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.