# CVE-2026-25951: FUXA path traversal sanitization bypass

Source: https://junglewise.ai/threats/cve-2026-25951-fuxa-path-traversal-sanitization-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-10. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-25951 · Severity: medium · CVSS 4 · Published 2026-02-10

FUXA is a Node.js-based industrial automation and SCADA visualization platform used to monitor and control critical infrastructure. An authenticated administrator can exploit a flaw in path validation to write malicious scripts to the server, leading to complete system compromise and potential disruption of industrial operations.

Technologies: [fuxa-server (npm)](https://junglewise.ai/threats/technologies/fuxa-server). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-25951 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-25951 being exploited in the wild.

**How severe is CVE-2026-25951?** Medium severity, with a CVSS score of 4, published 10 February 2026.

**Which products and versions are affected?** fuxa-server (npm) SEMVER:introduced=0,fixed=1.2.11.

**Is there a fix for CVE-2026-25951?** Yes. fuxa-server (npm): upgrade to 1.2.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-25951 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-25951?** Check whether you run fuxa-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- fuxa-server (npm): upgrade to 1.2.11 or later

  ```sh
  npm install fuxa-server@1.2.11
  ```


## Technical details

The vulnerability is a path traversal sanitization bypass (CWE-22, CWE-23, CWE-184) in FUXA's file handling endpoints. The server's single-pass regex sanitization is insufficient to block nested traversal sequences like ....//. An authenticated attacker with administrative privileges can bypass directory restrictions on multiple endpoints (/api/upload, /api/resources/remove, /api/logs) to write arbitrary files into critical directories such as runtime/scripts. When the server reloads these malicious scripts, it leads to Remote Code Execution. The vulnerability is a regression affecting FUXA versions up to 1.2.10 and is patched in version 1.2.11.

## Affected products

- FUXA fuxa-server <= 1.2.10

## Identifiers

- CVE-2026-25951
- GHSA-68m5-5w2h-h837

## Timeline

- 2026-02-10: disclosed
- 2026-02-10: patched: Patched in FUXA version 1.2.11

## References

- [https://github.com/frangoteam/FUXA/security/advisories/GHSA-68m5-5w2h-h837](https://github.com/frangoteam/FUXA/security/advisories/GHSA-68m5-5w2h-h837)

## Related threats

- [Frangoteam FUXA privilege escalation in Scheduler API](https://junglewise.ai/threats/cve-2026-47721-frangoteam-fuxa-privilege-escalation-in-scheduler-api)
- [frangoteam FUXA SQL injection in TDengine DAQ connector](https://junglewise.ai/threats/cve-2026-47720-frangoteam-fuxa-sql-injection-in-tdengine-daq-connector)
- [frangoteam FUXA unauthenticated SSRF in Socket.IO handlers](https://junglewise.ai/threats/cve-2026-47719-frangoteam-fuxa-unauthenticated-ssrf-in-socket-io-handlers)
- [frangoteam FUXA authentication bypass in protected read APIs](https://junglewise.ai/threats/cve-2026-47718-frangoteam-fuxa-authentication-bypass-in-protected-read-apis)
- [FUXA unauthenticated project data disclosure in API](https://junglewise.ai/threats/cve-2026-47717-fuxa-unauthenticated-project-data-disclosure-in-api)