CVE-2026-25895: FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 13.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-02-09 · updated 2026-06-17
Weakness: CWE-22

Description

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. A path traversal vulnerability in FUXA allows an unauthenticated, remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10.

Affected products

frangoteam FUXA: before 1.2.10 — fixed in 1.2.10

How to fix

Upgrade to a fixed version: frangoteam FUXA 1.2.10. Check the vendor advisory for mitigations.

References

https://github.com/frangoteam/FUXA/commit/22c2192f5d9beef8a787c45eff3a14c24dbb5f96
https://github.com/frangoteam/FUXA/releases/tag/v1.2.10
https://github.com/frangoteam/FUXA/security/advisories/GHSA-88qh-cphv-996c

Get alerted when CVE-2026-25895 or the next vulnerability affects your stack