9.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25895

CVE-2026-25895: FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. A path traversal vulnerability in FUXA allows an unauthenticated, remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25895

CVE-2026-25895:

9.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
fuxa-server	npm	<= 1.2.9	1.2.10

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the security patch (commit 22c2192f5d9beef8a787c45eff3a14c24dbb5f96) clearly indicates the source of the vulnerability. The patch was applied to the file server/api/projects/index.js, specifically to the Express.js-style route handler for POST /api/upload.

The root cause is twofold:

Missing Authentication: The endpoint was public, as shown by the removal of the simple callback function (req, res) and the addition of the secureFnc middleware and subsequent authorization checks. This allowed unauthenticated attackers to reach the vulnerable code path.
Path Traversal: The original code constructed the destination directory for file uploads using path.resolve(runtime.settings.appDir, _${destination}). The destinationvariable was taken directly from the request body without validation. This allowed an attacker to craft a maliciousdestinationstring with../` sequences to traverse the directory structure and write a file to any location the application's user had permissions for.

The patch addresses both issues by first enforcing authentication and authorization, and then by adding robust validation to the destination parameter. It normalizes the path, explicitly checks for traversal sequences (..), and ensures the final resolved path is within the intended base directory. The vulnerable function is the anonymous callback function that handles this API endpoint, which is best identified in a profiler by its route prjApp.post('/api/upload').

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.