FUXA <= 1.2.9 - Unauthenticated Path Traversal to Arbitrary File Write
FUXA, an open-source Node.js SCADA/HMI web interface, through version 1.2.9 exposes an unauthenticated POST /api/upload endpoint that resolves the attacker-controlled `destination` field from the JSON request body against the application directory with only a leading underscore prefix and no containment check. Because path.resolve() honours "../" segments, an unauthenticated attacker can escape the application directory and write arbitrary files anywhere on the filesystem reachable by the service account - for example into the public web root (a/../../client/dist), into cron directories, or over SSH authorized_keys - leading to remote code execution. Version 1.2.10 rejects any destination containing a traversal segment and additionally requires an authenticated administrator. References: https://github.com/frangoteam/FUXA/security/advisories/GHSA-88qh-cphv-996c https://github.com/frangoteam/FUXA/commit/22c2192f5d9beef8a787c45eff3a14c24dbb5f96 https://github.com/frangoteam/FUXA/releases/tag/v1.2.10 https://github.com/Hann1bl3L3ct3r/FUXAPWN https://nvd.nist.gov/vuln/detail/CVE-2026-25895 Remediation: Upgrade FUXA to version 1.2.10 or later, which validates and contains the `destination` parameter to the intended application directory and requires administrator authentication on /api/upload.
10 assets checked · domain, subdomain, ipv4