CVE-2026-25895: 
JavaScript vulnerability analysis and mitigation

CVE-2026-25895 is a path traversal vulnerability in FUXA, a web-based SCADA/HMI/Dashboard Process Visualization software, that allows an unauthenticated remote attacker to write arbitrary files to arbitrary locations on the server filesystem. It affects all FUXA deployments through version 1.2.9, including those with authentication enabled, and has been patched in version 1.2.10. The vulnerability was published on February 9, 2026, with the patch released on January 25, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 9.5 (Critical) (GHSA-88qh Advisory, Feedly).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and CWE-306 (Missing Authentication for Critical Function), rooted in FUXA's file upload API failing to sanitize user-supplied path components and lacking authentication enforcement (GHSA-88qh Advisory). An attacker can send a crafted HTTP request to the upload endpoint with path traversal sequences (e.g., ../) in the filename parameter, causing the server to write attacker-controlled content to arbitrary filesystem locations outside the intended upload directory. This vulnerability affects all deployments regardless of whether runtime.settings.secureEnabled is set to true, meaning authentication bypass is not required — the upload endpoint itself is unauthenticated. If the attacker overwrites application code, startup scripts, or configuration files that are subsequently executed or loaded, remote code execution (RCE) is achievable (GHSA-88qh Advisory). A public technical write-up and exploit code are available at Infinitsec and Exploit-DB.

Successful exploitation allows an unauthenticated remote attacker to overwrite arbitrary files on the server filesystem, including application code, startup scripts, and configuration files, which can lead to full remote code execution in the context of the FUXA service account (GHSA-88qh Advisory). The confidentiality, integrity, and availability impacts are all rated High, as an attacker can read sensitive data, modify or destroy system files, and disrupt service operation. Given FUXA's role as SCADA/HMI software in industrial environments, exploitation could expose connected ICS/SCADA systems to follow-on actions including malware deployment, operational disruption, and lateral movement into operational technology (OT) networks (Feedly).

A public proof-of-concept exploit is available on GitHub (FUXAPWN PoC) and a weaponized exploit has been published on Exploit-DB (Exploit-DB) and indexed on Sploitus. The vulnerability requires no authentication, no user interaction, and is exploitable remotely over the network, making it highly automatable. The EPSS score is approximately 0.168%, indicating a relatively low but non-negligible probability of exploitation in the wild; no active in-the-wild exploitation or specific threat actor attribution has been confirmed at this time, and the vulnerability is not currently listed in the CISA KEV catalog (Feedly).

1. Reconnaissance: Identify internet-facing FUXA instances (version ≤ 1.2.9) using tools like Shodan or Censys, searching for the FUXA web interface (default port 1881).
2. Identify the upload endpoint: Locate the unauthenticated file upload API endpoint in FUXA (e.g., the upload API used for project assets or media files).
3. Craft path traversal payload: Construct a multipart HTTP POST request to the upload endpoint with a filename parameter containing path traversal sequences such as ../../ to escape the intended upload directory and target a writable location (e.g., a startup script or application code file).
4. Write malicious file: Upload a malicious payload (e.g., a Node.js script or shell script) to a location that will be executed by the FUXA service or the underlying OS on startup or during normal operation.
5. Trigger execution: Restart the FUXA service (if possible via another API endpoint) or wait for the application to load/execute the overwritten file, achieving remote code execution in the context of the FUXA service account.
6. Post-exploitation: Use the established foothold to pivot into connected ICS/SCADA environments, deploy persistent backdoors, or exfiltrate sensitive operational data (GHSA-88qh Advisory, Exploit-DB).

• Network: Unexpected HTTP POST requests to FUXA upload API endpoints (e.g., /api/... upload paths) from unauthenticated sources; outbound connections from the FUXA server to unknown external IPs following file upload activity.
• File System: Presence of unexpected or modified files in FUXA installation directories, startup script locations, or system directories (e.g., /etc/cron.d/, /etc/init.d/, or Node.js application directories); newly created files with web shell or reverse shell content.
• Logs: FUXA access logs showing POST requests to upload endpoints with filenames containing ../ or URL-encoded path traversal sequences (%2e%2e%2f); HTTP 200 responses to unauthenticated upload requests.
• Process: Unusual child processes spawned by the FUXA Node.js process (e.g., bash, sh, curl, wget, python, nc); unexpected outbound network connections initiated by the FUXA service process.

The primary remediation is to upgrade FUXA to version 1.2.10 or later, which enforces authentication on the upload API and hardens file upload validation (FUXA v1.2.10 Release). As an interim workaround while patching, restrict network access to FUXA instances to trusted internal networks only using firewall rules, and avoid exposing FUXA directly to the internet. Organizations should also review their FUXA deployment for signs of compromise before applying the patch, given the availability of public exploit code (GHSA-88qh Advisory).

The vulnerability was reported by researcher 'wodzen' and coordinated through GitHub Security Advisories, with the FUXA maintainer (unocelli) publishing the advisory on February 4, 2026 (GHSA-88qh Advisory). The advisory notes that GitHub had previously published a duplicate CVE (CVE-2025-69981) out of band before coordinated disclosure concluded, with an inaccurate CWE classification (CWE-434 instead of CWE-22). Security community discussion was observed on Mastodon/infosec.exchange and threat intelligence platforms, with the vulnerability attracting attention due to its critical severity and ICS/SCADA context (Feedly).