Is CVE-2026-25895 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-25895 being exploited in the wild.

How severe is CVE-2026-25895?

Medium severity, with a CVSS score of 4, published 5 February 2026.

Which products and versions are affected?

fuxa-server (npm) SEMVER:introduced=0,fixed=1.2.10.

Is there a fix for CVE-2026-25895?

Yes. fuxa-server (npm): upgrade to 1.2.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-25895 attacked?

It is attacked over the network.

Am I affected by CVE-2026-25895?

Check whether you run fuxa-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-25895: FUXA path traversal arbitrary file write in upload API

CVE-2026-25895 · Severity: medium · CVSS 4 · Published 2026-02-05

FUXA is an open-source industrial IoT framework used to monitor and control manufacturing systems and SCADA environments. An unauthenticated attacker can exploit a path traversal flaw in the file upload API to write arbitrary files anywhere on the server filesystem, potentially overwriting critical application code, configuration files, or startup scripts. If successful, this leads to remote code execution and full system compromise, with particular risk to connected industrial control systems.

Technologies: fuxa-server (npm). Vendors: npm.

Quick answers

Is CVE-2026-25895 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-25895 being exploited in the wild.
How severe is CVE-2026-25895?: Medium severity, with a CVSS score of 4, published 5 February 2026.
Which products and versions are affected?: fuxa-server (npm) SEMVER:introduced=0,fixed=1.2.10.
Is there a fix for CVE-2026-25895?: Yes. fuxa-server (npm): upgrade to 1.2.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-25895 attacked?: It is attacked over the network.
Am I affected by CVE-2026-25895?: Check whether you run fuxa-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

fuxa-server (npm): upgrade to 1.2.10 or later
```
npm install fuxa-server@1.2.10
```

Technical details

A path traversal vulnerability (CWE-22) in FUXA's upload API allows an unauthenticated, remote attacker to write arbitrary files to arbitrary locations on the server filesystem. The vulnerability exists in all versions through 1.2.9 and is unaffected by the runtime.settings.secureEnabled setting. By overwriting executable files, startup scripts, or configuration files that are subsequently loaded or executed, an attacker can achieve remote code execution. The attack requires network reachability to the upload API endpoint but no authentication or user interaction. The vulnerability has been patched in version 1.2.10.

Affected products

FUXA FUXA through 1.2.9

Identifiers

CVE-2026-25895
GHSA-88qh-cphv-996c

Timeline

2026-02-05: disclosed: GitHub advisory GHSA-88qh-cphv-996c published
2026-02-05: patched: Version 1.2.10 released with fix
2025: other: Related CVE-2025-69981 published out of band before coordinated disclosure

References

https://github.com/frangoteam/FUXA/security/advisories/GHSA-88qh-cphv-996c

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.