# CVE-2023-31718: FUXA local file inclusion in download endpoint

Source: https://junglewise.ai/threats/cve-2023-31718-fuxa-local-file-inclusion-in-download-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-09-22. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2023-31718 · Severity: low · CVSS 3.1 · Published 2023-09-22

FUXA is an open-source industrial automation and SCADA visualization platform used to monitor and control manufacturing operations. The /api/download endpoint contains a path traversal flaw that allows an attacker to read arbitrary files from the server without authentication, potentially exposing sensitive configuration files, credentials, and operational data.

Technologies: [fuxa-server (npm)](https://junglewise.ai/threats/technologies/fuxa-server). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2023-31718 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-31718 being exploited in the wild.

**How severe is CVE-2023-31718?** Low severity, with a CVSS score of 3.1, published 22 September 2023.

**Which products and versions are affected?** fuxa-server (npm) SEMVER:introduced=0,last_affected=1.1.12.

**Is there a fix for CVE-2023-31718?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2023-31718 attacked?** It is attacked over the network.

**Am I affected by CVE-2023-31718?** Check whether you run fuxa-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

FUXA versions up to 1.1.12 contain a local file inclusion (LFI) vulnerability in the /api/download endpoint (CWE-98). The "name" parameter does not properly sanitize path traversal sequences (../, etc.), allowing an unauthenticated remote attacker to read arbitrary files from the server using a specially crafted request like /api/download?cmd=REPORT-DOWNLOAD&name=../../../../../../etc/passwd. No authentication is required and the attack is trivial to execute from the network. Successful exploitation allows an attacker to disclose sensitive files including system configuration, credentials, and application source code.

## Affected products

- FUXA FUXA Server <=1.1.12

## Identifiers

- CVE-2023-31718
- GHSA-wwfj-h843-3hrq

## Timeline

- 2023-09-22: disclosed

## References

- [https://github.com/MateusTesser/CVE-2023-31718](https://github.com/MateusTesser/CVE-2023-31718)

## Related threats

- [Frangoteam FUXA privilege escalation in Scheduler API](https://junglewise.ai/threats/cve-2026-47721-frangoteam-fuxa-privilege-escalation-in-scheduler-api)
- [frangoteam FUXA SQL injection in TDengine DAQ connector](https://junglewise.ai/threats/cve-2026-47720-frangoteam-fuxa-sql-injection-in-tdengine-daq-connector)
- [frangoteam FUXA unauthenticated SSRF in Socket.IO handlers](https://junglewise.ai/threats/cve-2026-47719-frangoteam-fuxa-unauthenticated-ssrf-in-socket-io-handlers)
- [frangoteam FUXA authentication bypass in protected read APIs](https://junglewise.ai/threats/cve-2026-47718-frangoteam-fuxa-authentication-bypass-in-protected-read-apis)
- [FUXA unauthenticated project data disclosure in API](https://junglewise.ai/threats/cve-2026-47717-fuxa-unauthenticated-project-data-disclosure-in-api)