CVE Intelligence
Analysis AI-assisted

CVE-2026-25895: FUXA Path Traversal Enables Unauthenticated Arbitrary File Write and Remote Code Execution Risk

NVD rates this FUXA path traversal flaw critical (score 9.8), and it allows unauthenticated remote attackers to write arbitrary files on the server. Versions before 1.2.10 are affected, and the fix is available in 1.2.10. The record does not list this issue in CISA KEV, and no confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

FUXA is web-based process visualization software for SCADA, HMI and dashboard use. The GitHub advisory and the NVD record describe a path traversal weakness that lets an unauthenticated remote attacker write files to arbitrary locations on the server filesystem.

Impact

  • Confirmed: arbitrary file write, reachable remotely and without authentication.
  • Inference: writing arbitrary files on an industrial visualization server can compromise integrity and availability. Depending on the deployment, it may also enable code execution, which the record title describes as remote code execution.
  • NVD assigns a score of 9.8 (critical). GitHub, as CNA, assigns 9.5.

Affected products and versions

  • Product: Frangoteam Fuxa.
  • Affected: versions before 1.2.10, meaning through 1.2.9 inclusive.
  • Fixed in: 1.2.10.
  • The record provides no further version detail.

Exploitation status

The record marks FUXA as not listed in CISA KEV, and SSVC exploitation as none. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Upgrade FUXA to version 1.2.10, which contains the fix referenced in the project commit.
  • If an upgrade cannot happen immediately, restrict network access to the FUXA interface, avoid direct internet exposure, and place the system behind authenticated access controls. These are general recommendations, not vendor instructions.
  • Review the GitHub advisory for the vendor's own guidance.

Detection guidance

  • Review web server and application logs for unexpected requests to upload endpoints, especially from unfamiliar sources.
  • Monitor for files created or modified outside the expected upload folder, including application and configuration directories.
  • Consider file integrity monitoring on hosts running FUXA.

Limitations of the available information

  • The record does not identify the exact vulnerable endpoint, the file types involved, or the conditions required for exploitation.
  • The record does not state whether workarounds exist besides the upgrade.
  • Exposure of a given deployment depends on its network configuration, which the sources do not describe.

Frequently asked questions

What is the core problem in CVE-2026-25895?

FUXA has a path traversal weakness in its upload handling that lets an unauthenticated remote attacker write files to arbitrary locations on the server. The record links this to CWE-22, Path Traversal.

Which FUXA versions are affected and what fixes them?

Versions before 1.2.10 are affected, meaning through 1.2.9. The issue is fixed in 1.2.10, according to the record.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.