Is CVE-2026-25951 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-25951 being exploited in the wild.

How severe is CVE-2026-25951?

Medium severity, with a CVSS score of 4, published 10 February 2026.

Which products and versions are affected?

fuxa-server (npm) SEMVER:introduced=0,fixed=1.2.11.

Is there a fix for CVE-2026-25951?

Yes. fuxa-server (npm): upgrade to 1.2.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-25951 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-25951?

Check whether you run fuxa-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-25951: FUXA path traversal sanitization bypass

CVE-2026-25951 · Severity: medium · CVSS 4 · Published 2026-02-10

FUXA is a Node.js-based industrial automation and SCADA visualization platform used to monitor and control critical infrastructure. An authenticated administrator can exploit a flaw in path validation to write malicious scripts to the server, leading to complete system compromise and potential disruption of industrial operations.

Technologies: fuxa-server (npm). Vendors: npm.

Quick answers

Is CVE-2026-25951 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-25951 being exploited in the wild.
How severe is CVE-2026-25951?: Medium severity, with a CVSS score of 4, published 10 February 2026.
Which products and versions are affected?: fuxa-server (npm) SEMVER:introduced=0,fixed=1.2.11.
Is there a fix for CVE-2026-25951?: Yes. fuxa-server (npm): upgrade to 1.2.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-25951 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-25951?: Check whether you run fuxa-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

fuxa-server (npm): upgrade to 1.2.11 or later
```
npm install fuxa-server@1.2.11
```

Technical details

The vulnerability is a path traversal sanitization bypass (CWE-22, CWE-23, CWE-184) in FUXA's file handling endpoints. The server's single-pass regex sanitization is insufficient to block nested traversal sequences like ....//. An authenticated attacker with administrative privileges can bypass directory restrictions on multiple endpoints (/api/upload, /api/resources/remove, /api/logs) to write arbitrary files into critical directories such as runtime/scripts. When the server reloads these malicious scripts, it leads to Remote Code Execution. The vulnerability is a regression affecting FUXA versions up to 1.2.10 and is patched in version 1.2.11.

Affected products

FUXA fuxa-server <= 1.2.10

Identifiers

CVE-2026-25951
GHSA-68m5-5w2h-h837

Timeline

2026-02-10: disclosed
2026-02-10: patched: Patched in FUXA version 1.2.11

References

https://github.com/frangoteam/FUXA/security/advisories/GHSA-68m5-5w2h-h837

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.