CVE-2025-69981: 
JavaScript vulnerability analysis and mitigation

CVE-2025-69981 is an Unrestricted File Upload vulnerability (CWE-434) in FUXA v1.2.7, an open-source web-based SCADA/HMI platform developed by frangoteam. The /api/upload API endpoint lacks authentication mechanisms, allowing unauthenticated remote attackers to upload arbitrary files to the server. This can be exploited to overwrite critical system files (such as the SQLite user database) to gain administrative access, or to upload malicious scripts for arbitrary code execution. It carries a CVSS v3.1 base score of 9.8 (Critical) (Red Hat Advisory, Feedly). The vulnerability was published on February 3, 2026.

The root cause is the absence of authentication enforcement on the POST /api/upload endpoint in server/api/projects/index.js (around line 193). While other sensitive endpoints in the same file use secureFnc middleware and check for admin permissions via authJwt.haveAdminPermission(), the upload endpoint accepts file data and writes it directly to the filesystem using fs.writeFileSync() without verifying the caller's identity or authorization. An attacker can supply arbitrary file content via the resource.data field and control the destination path using the destination parameter, subject only to path normalization checks added in the current codebase. The vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type) and is remotely exploitable with no authentication, no user interaction, and low attack complexity (FUXA Source, Red Hat Advisory).

Successful exploitation results in complete compromise of confidentiality, integrity, and availability of affected FUXA instances. An attacker can overwrite the SQLite user database to inject a rogue administrative account, gaining full control of the SCADA/HMI application and any connected industrial devices or processes. Alternatively, uploading a malicious server-side script (e.g., a Node.js or shell script) to a web-accessible directory enables arbitrary code execution under the FUXA service account, potentially facilitating lateral movement within OT/ICS environments (Feedly, FUXA Source).

No public proof-of-concept exploit code has been confirmed at this time, and there is no evidence of active in-the-wild exploitation (Feedly). The EPSS score is approximately 0.069%, reflecting low current exploitation probability. The vulnerability has been detected by Qualys (detection ID 5007414) and a Nuclei template pull request has been submitted to ProjectDiscovery's nuclei-templates repository, indicating community interest in automated detection (Feedly). The CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify internet-facing or network-accessible FUXA v1.2.7 instances using tools like Shodan (search for fuxa or the default FUXA web port, typically 1881) or by scanning internal OT/ICS network segments.
2. Confirm vulnerability: Send a benign test POST request to /api/upload without any authentication headers to confirm the endpoint accepts unauthenticated requests and returns a 200 response.
3. Craft malicious payload: Prepare a multipart or JSON POST body with resource.data containing the malicious file content (e.g., a web shell or a crafted SQLite database), resource.name set to the target filename, and optionally destination to control the write path.
4. Overwrite user database (privilege escalation path): Upload a crafted SQLite database file to overwrite the FUXA user database (e.g., _db/fuxa.db), inserting a known admin credential hash to gain administrative login access.
5. Upload malicious script (RCE path): Upload a Node.js script or shell script to a directory accessible by the FUXA runtime, then trigger its execution through another application mechanism or by restarting the service.
6. Achieve objectives: With admin access or code execution, interact with connected PLCs, HMIs, or SCADA devices; exfiltrate project data; or pivot to other systems on the OT network (FUXA Source, Feedly).

• Network: Unexpected POST requests to /api/upload from unauthenticated or external IP addresses; unusual outbound connections from the FUXA server process after file uploads.
• Logs: FUXA application logs showing api upload entries with unfamiliar file names or paths; absence of authentication errors preceding successful upload responses (HTTP 200) to /api/upload.
• File System: Unexpected or newly created files in the FUXA upload directory (uploadFileDir) or application data directory (e.g., ~/.fuxa/); modifications to the SQLite user database (fuxa.db) with timestamps inconsistent with normal admin activity; presence of script files (.js, .sh, .py) in web-accessible directories.
• Process: Unusual child processes spawned by the FUXA Node.js process (e.g., bash, sh, curl, wget); unexpected database file modifications detected by file integrity monitoring tools (FUXA Source).

No official patch has been confirmed for FUXA v1.2.7 at the time of publication; users should monitor the FUXA GitHub repository for updates and upgrade as soon as a fixed version is released (Red Hat Advisory). As an immediate workaround, restrict network access to the FUXA web interface using firewall rules or a WAF, blocking unauthenticated external access to the /api/upload endpoint. Additionally, apply the principle of least privilege to the FUXA service account, enable file integrity monitoring on the FUXA data directory, and monitor upload activity logs for anomalous file types or paths.

Red Hat has published a security advisory tracking this CVE, indicating awareness within the enterprise security community (Red Hat Advisory). A pull request to add a Nuclei detection template for CVE-2025-69981 was submitted to ProjectDiscovery's nuclei-templates repository, reflecting community interest in automated scanning for this vulnerability (Nuclei Templates PR). The vulnerability has also been indexed by GitLab's advisory database for the fuxa-server npm package (GitLab Advisory).