# CVE-2026-25895: FUXA path traversal arbitrary file write in upload API

Source: https://junglewise.ai/threats/cve-2026-25895-fuxa-path-traversal-arbitrary-file-write-in-upload-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-05. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-25895 · Severity: medium · CVSS 4 · Published 2026-02-05

FUXA is an open-source industrial IoT framework used to monitor and control manufacturing systems and SCADA environments. An unauthenticated attacker can exploit a path traversal flaw in the file upload API to write arbitrary files anywhere on the server filesystem, potentially overwriting critical application code, configuration files, or startup scripts. If successful, this leads to remote code execution and full system compromise, with particular risk to connected industrial control systems.

Technologies: [fuxa-server (npm)](https://junglewise.ai/threats/technologies/fuxa-server). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-25895 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-25895 being exploited in the wild.

**How severe is CVE-2026-25895?** Medium severity, with a CVSS score of 4, published 5 February 2026.

**Which products and versions are affected?** fuxa-server (npm) SEMVER:introduced=0,fixed=1.2.10.

**Is there a fix for CVE-2026-25895?** Yes. fuxa-server (npm): upgrade to 1.2.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-25895 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-25895?** Check whether you run fuxa-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- fuxa-server (npm): upgrade to 1.2.10 or later

  ```sh
  npm install fuxa-server@1.2.10
  ```


## Technical details

A path traversal vulnerability (CWE-22) in FUXA's upload API allows an unauthenticated, remote attacker to write arbitrary files to arbitrary locations on the server filesystem. The vulnerability exists in all versions through 1.2.9 and is unaffected by the runtime.settings.secureEnabled setting. By overwriting executable files, startup scripts, or configuration files that are subsequently loaded or executed, an attacker can achieve remote code execution. The attack requires network reachability to the upload API endpoint but no authentication or user interaction. The vulnerability has been patched in version 1.2.10.

## Affected products

- FUXA FUXA through 1.2.9

## Identifiers

- CVE-2026-25895
- GHSA-88qh-cphv-996c

## Timeline

- 2026-02-05: disclosed: GitHub advisory GHSA-88qh-cphv-996c published
- 2026-02-05: patched: Version 1.2.10 released with fix
- 2025: other: Related CVE-2025-69981 published out of band before coordinated disclosure

## References

- [https://github.com/frangoteam/FUXA/security/advisories/GHSA-88qh-cphv-996c](https://github.com/frangoteam/FUXA/security/advisories/GHSA-88qh-cphv-996c)

## Related threats

- [Frangoteam FUXA privilege escalation in Scheduler API](https://junglewise.ai/threats/cve-2026-47721-frangoteam-fuxa-privilege-escalation-in-scheduler-api)
- [frangoteam FUXA SQL injection in TDengine DAQ connector](https://junglewise.ai/threats/cve-2026-47720-frangoteam-fuxa-sql-injection-in-tdengine-daq-connector)
- [frangoteam FUXA unauthenticated SSRF in Socket.IO handlers](https://junglewise.ai/threats/cve-2026-47719-frangoteam-fuxa-unauthenticated-ssrf-in-socket-io-handlers)
- [frangoteam FUXA authentication bypass in protected read APIs](https://junglewise.ai/threats/cve-2026-47718-frangoteam-fuxa-authentication-bypass-in-protected-read-apis)
- [FUXA unauthenticated project data disclosure in API](https://junglewise.ai/threats/cve-2026-47717-fuxa-unauthenticated-project-data-disclosure-in-api)