CVE-2026-25895 Details.
FUXA <= 1.2.9 - Unauthenticated Path Traversal to Arbitrary File Write
Atlas does not check this one. Needs requests that change data.
To test for this one, the check would have to send requests that could change data on the site. Atlas only ever reads public pages, so it does not run this check.
About CVE-2026-25895. What It Means.
FUXA, an open-source Node.js SCADA/HMI web interface, through version 1.2.9 exposes an unauthenticated POST /api/upload endpoint that resolves the attacker-controlled `destination` field from the JSON request body against the application directory with only a leading underscore prefix and no containment check. Because path.resolve() honours "../" segments, an unauthenticated attacker can escape the application directory and write arbitrary files anywhere on the filesystem re…
Affected Product. What Is Hit.
- Vendor
- frangoteam
- Product
- Frangoteam FUXA
References. Where To Read More.
More CVEs In Frangoteam FUXA.
FAQ
Common Questions.
FUXA <= 1.2.9 - Unauthenticated Path Traversal to Arbitrary File Write. FUXA, an open-source Node.js SCADA/HMI web interface, through version 1.2.9 exposes an unauthenticated POST /api/upload endpoint that resolves the attacker-controlled `destination` field from the JSON request body against the application directory with only a leading underscore prefix and no containment check. Because path.resolve() honours "../" segments, an unauthenticated attacker can escape the application directory and write arbitrary files anywhere on the filesystem re…
No. To test for this one, the check would have to send requests that could change data on the site. Atlas only ever reads public pages, so it does not run this check. The facts about CVE-2026-25895 are on this page, and you can request a demo to see how Brandefense watches your whole external attack surface.
CVE-2026-25895 is not on the CISA Known Exploited Vulnerabilities list at the time of writing, but it is still worth fixing.
Update Frangoteam FUXA to the latest version from the vendor, or follow the vendor's advice to switch off the affected feature. Vendor links are listed on this page when they are known.
This page lists the public facts about CVE-2026-25895. Atlas does not run a check for it, so nothing here says whether a particular site is affected.