by Kastro
Paper/Archive/CVE-2026-25895

CVE-2026-25895

frangoteam FUXA — FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API

EPSS 13%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 96.3.963 × 2019.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. A path traversal vulnerability in FUXA allows an unauthenticated, remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10.

Affected

ProductAffectedFixed inSource
FUXA< 1.2.10–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub_M (CNA)9.5CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/frangoteam/FUXA/security/advisories/GHSA-88qh-cphv-996crefgithub.com/frangoteam/FUXA/commit/22c2192f5d9beef8a787c45eff3a14c24dbb5f96refgithub.com/frangoteam/FUXA/releases/tag/v1.2.10