8.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25951

CVE-2026-25951: FUXA has a Path Traversal Sanitization Bypass

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.2.11, there is a flaw in the path sanitization logic allows an authenticated attacker with administrative privileges to bypass directory traversal protections. By using nested traversal sequences (e.g., ....//), an attacker can write arbitrary files to the server filesystem, including sensitive directories like runtime/scripts. This leads to Remote Code Execution (RCE) when the server reloads the malicious scripts. This vulnerability is fixed in 1.2.11.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25951

CVE-2026-25951:

8.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
fuxa-server	npm	<= 1.2.10	1.2.11

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a path traversal sanitization bypass in multiple API endpoints of FUXA. The root cause was the use of a simple, single-pass string replacement (.replace('../', '')) to sanitize user-provided file paths. This method is insufficient and can be bypassed using nested traversal sequences like ....//. An attacker could exploit this flaw in endpoints responsible for file uploads, downloads, and deletions (/api/upload, /api/command, /api/logs, /api/resources/remove, /api/reports/remove).

The successful exploitation of the file upload endpoint (/api/upload) has the highest impact, as it allows an attacker to write a malicious script file to a sensitive directory (e.g., runtime/scripts). When the server reloads these scripts, it results in Remote Code Execution (RCE), giving the attacker full control over the system. Other affected endpoints allow for arbitrary file reading and deletion, leading to information disclosure and denial of service.

The patch addresses this by introducing a robust path sanitization utility (path-helper.js) that normalizes and resolves paths within a designated base directory, effectively preventing any traversal outside of it. The vulnerable functions were identified by locating where the inadequate string replacement was replaced by calls to this new, secure utility.

Vulnerable functions

GET /scada/api/command

server/api/command/index.js

The endpoint for downloading reports was vulnerable to path traversal. The `name` query parameter was sanitized using a simple string replacement that could be bypassed with nested traversal sequences (e.g., '....//'), allowing an attacker to read arbitrary files from the server's filesystem.

GET /scada/api/logs

server/api/diagnose/index.js

The endpoint for fetching log files was vulnerable to path traversal. The `file` query parameter was not properly sanitized, allowing an attacker to specify a path that traverses outside the intended logs directory and read arbitrary files.

POST /scada/api/upload

server/api/projects/index.js

The file upload endpoint was vulnerable to path traversal through the 'file.name', 'file.fullPath', and 'destination' parameters. The sanitization logic was insufficient and could be bypassed, allowing an authenticated attacker to write arbitrary files to any location on the filesystem, leading to Remote Code Execution (RCE).

ReportsApiService.onReportRemove

server/api/reports/reports.service.ts

The report removal function was vulnerable to path traversal. It constructed the path to the file to be deleted by directly concatenating a base directory with the user-provided 'fileName' parameter without proper sanitization. This allowed an attacker to delete arbitrary files from the server.

POST /scada/api/resources/remove

server/api/resources/index.js

The resource removal endpoint was vulnerable to path traversal. The `file` parameter in the request body was sanitized with a simple string replacement, which could be bypassed to allow an attacker to delete arbitrary files from the server's filesystem.

POST /scada/api/resources/widgets

server/api/resources/index.js

The endpoint for loading widget resources was vulnerable to path traversal. The 'path' parameter in the request body was inadequately sanitized, allowing an attacker to read files from outside the intended widgets directory.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.