Executive brief
FUXA is an open-source industrial IoT framework used to monitor and control manufacturing systems and SCADA environments. An unauthenticated attacker can exploit a path traversal flaw in the file upload API to write arbitrary files anywhere on the server filesystem, potentially overwriting critical application code, configuration files, or startup scripts. If successful, this leads to remote code execution and full system compromise, with particular risk to connected industrial control systems.
Technical details
A path traversal vulnerability (CWE-22) in FUXA's upload API allows an unauthenticated, remote attacker to write arbitrary files to arbitrary locations on the server filesystem. The vulnerability exists in all versions through 1.2.9 and is unaffected by the runtime.settings.secureEnabled setting. By overwriting executable files, startup scripts, or configuration files that are subsequently loaded or executed, an attacker can achieve remote code execution. The attack requires network reachability to the upload API endpoint but no authentication or user interaction. The vulnerability has been patched in version 1.2.10.
Affected products
- FUXA FUXA through 1.2.9
Timeline
- 2026-02-05: disclosed: GitHub advisory GHSA-88qh-cphv-996c published
- 2026-02-05: patched: Version 1.2.10 released with fix
- 2025: other: Related CVE-2025-69981 published out of band before coordinated disclosure