Fuxa
CVE-2026-25895
CRITICAL
GHSA-88qh-cphv-996c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend HTTP request with path traversal payload
-
ExploitBypass file path validation in upload handler
-
ExecutionWrite arbitrary file to server filesystem
-
ImpactAchieve remote code execution or data manipulation
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | FUXA versions through 1.2.9 with unauthenticated file upload or write functionality exposed. No special conditions — remote unauthenticated exploitation against default FUXA installations accepting file write requests. |
| Impact | CVSS 9.8 with patch. |
| Exploit ScenarioDerived | An attacker reads or writes arbitrary files on the SCADA server. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
FUXA SCADA has a path traversal vulnerability — ninth critical vulnerability enabling arbitrary file access on SCADA servers.
Earlier versions of this analysis (1)
Ninth FUXA SCADA critical vulnerability — path traversal.
RemediationAI
Update FUXA.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-22 path traversal in FUXA SCADA.
Know when Fuxa gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. A path traversal vulnerability in FUXA allows an unauthenticated, remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10.
Executive ViewAI
FUXA deployments face a critical, unauthenticated remote code execution risk through a path traversal flaw that allows attackers to write arbitrary files to your servers without credentials. Any organization running FUXA-based SCADA/HMI systems is immediately at risk of operational disruption, data theft, and potential safety incidents in industrial environments.
Apply vendor patch. If patch deployment is delayed: restrict network access to FUXA via firewall/WAF to trusted IPs only; disable public internet exposure; implement reverse proxy with authentication; monitor file system writes for suspicious activity; increase logging and SIEM alerting on FUXA processes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Exploit-DB
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Affected Products (CPE)GitHub Advisory
FUXA v1.2.7 has hard-coded JWT credentials (EPSS 4.8%) that allow attackers to forge authentication tokens and bypass al
Authentication bypass in FUXA SCADA/HMI system 1.2.8 and prior leading to Remote Code Execution. Unauthenticated attacke
FUXA <= 1.1.12 is vulnerable to SQL Injection via /api/signin. Rated critical severity (CVSS 9.8), this vulnerability is
A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute
FUXA <= 1.1.12 is vulnerable to Local via Inclusion via /api/download. Rated high severity (CVSS 7.5), this vulnerabilit
A SQL Injection attack in FUXA <= 1.1.12 allows exfiltration of confidential information from the database. Rated high s
FUXA v1.2.7 allows remote code execution through the project import functionality by importing crafted project files con
FUXA SCADA has yet another authorization bypass — now the seventh critical FUXA vulnerability discovered, enabling unaut
FUXA SCADA has an authentication spoofing vulnerability from versions 1.2.8 through 1.2.10 — tenth critical vulnerabilit
FUXA SCADA has insecure default configuration with a known JWT secret — eighth critical vulnerability.
FUXA v1.2.7 has an unrestricted file upload in the /api/upload endpoint that lacks authentication and file type validati
FUXA v1.2.7 SCADA/HMI system has insecure default configuration with security disabled by default, exposing industrial c