CVE-2026-25951: 
JavaScript vulnerability analysis and mitigation

CVE-2026-25951 is a path traversal sanitization bypass vulnerability in FUXA, a web-based SCADA/HMI/Dashboard software developed by frangoteam. The flaw exists in the path sanitization logic of FUXA versions up to and including 1.2.10 (npm package fuxa-server), allowing an authenticated attacker with administrative privileges to bypass directory traversal protections using nested traversal sequences (e.g., ....//). This can result in arbitrary file writes to the server filesystem and ultimately Remote Code Execution (RCE). The vulnerability was published on February 9, 2026, and patched in version 1.2.11. It carries a CVSS v3.1 base score of 7.2 (High) and a CVSS v4.0 base score of 8.6 (High) (GitHub Advisory, FUXA Security Advisory).

The root cause is an incomplete input validation mechanism (CWE-22, CWE-23, CWE-184) in FUXA's path sanitization logic. The prior fix used a "single-pass" regex replacement (e.g., replace(new RegExp('../', 'g'), '')) that is insufficient against nested traversal sequences like ....// — after the inner ../ is stripped, the outer sequence collapses into a valid ../ traversal. This bypass affects multiple API endpoints: /api/upload, /api/resources/remove, and /api/logs, expanding the attack surface beyond the previously patched /api/download endpoint. An attacker can exploit this to write arbitrary files — including malicious scripts — into sensitive server directories such as runtime/scripts, which are subsequently loaded and executed by the server, achieving RCE (GitHub Advisory, FUXA Security Advisory, Patch Commit).

Successful exploitation allows an authenticated administrator to escalate from application-level control to full server compromise via Remote Code Execution. Beyond RCE, the vulnerability enables SCADA operational disruption — including potential physical or operational sabotage through manipulation of industrial tags and alarms — as well as full access to project data, credentials, and historical logs. Given FUXA's role as a SCADA/HMI platform, exploitation could have significant consequences for operational technology (OT) environments, including disruption of industrial processes (GitHub Advisory, FUXA Security Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The vulnerability requires authenticated access with administrative privileges, which limits the attack surface compared to unauthenticated vulnerabilities. The EPSS score is approximately 0.037% (11th percentile), indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Authenticate as Administrator: Obtain valid administrative credentials for the FUXA web interface (e.g., through credential theft, default credentials, or social engineering) and authenticate to the application.
2. Identify vulnerable endpoints: Confirm the FUXA instance is running a version ≤ 1.2.10 by reviewing version information in the UI or HTTP response headers. Target endpoints include /api/upload, /api/resources/remove, and /api/logs.
3. Craft nested traversal payload: Construct a file path using nested traversal sequences such as ....//....//runtime/scripts/malicious.js. The single-pass regex sanitization strips the inner ../, leaving a functional ../ traversal after normalization.
4. Upload malicious script: Send an authenticated HTTP POST request to /api/upload with the crafted path as the file.name or file.fullPath parameter and a malicious Node.js script as the file content, targeting the runtime/scripts directory.
5. Trigger server reload: Wait for or trigger a server reload/restart so that FUXA loads the malicious script from runtime/scripts, executing attacker-controlled code with server process privileges.
6. Achieve RCE: The malicious script executes on the server, enabling reverse shell establishment, data exfiltration, lateral movement, or manipulation of SCADA tags and alarms (GitHub Advisory, FUXA Security Advisory).

• Network: Authenticated HTTP POST requests to /api/upload, /api/resources/remove, or /api/logs containing path parameters with nested traversal sequences (e.g., ....//, ....\\); unexpected outbound connections from the FUXA server process to external IPs.
• File System: Unexpected or newly created .js files in the runtime/scripts directory; files with unusual names or content (e.g., reverse shell code) in directories outside the intended upload path; modification timestamps on files in runtime/scripts that do not correspond to legitimate administrative activity.
• Logs: FUXA access logs showing requests to /api/upload or /api/resources/remove with encoded or obfuscated path parameters containing .. sequences; HTTP 200 responses to requests with traversal patterns that should have been rejected.
• Process: Unexpected child processes spawned by the FUXA Node.js process (e.g., bash, sh, curl, wget, python); unusual network connections initiated by the FUXA server process.

The vulnerability is fixed in FUXA version 1.2.11, which introduces a robust path-helper.js module implementing normalizeRelativePath() and resolveWithin() functions that properly validate and confine file paths to their intended base directories. Users should upgrade to version 1.2.11 or later immediately (FUXA Release v1.2.11, Patch Commit). As interim mitigations, restrict administrative account access to trusted personnel only, apply the principle of least privilege for administrative roles, and monitor the runtime/scripts directory for unauthorized file modifications. Network-level controls (e.g., firewall rules limiting access to the FUXA web interface) can reduce exposure.

The vulnerability was reported by security researcher h1dr1 and published by the FUXA maintainer unocelli on February 9, 2026, alongside the patched release. The advisory notes this is a distinct regression from the previously patched CVE-2023-31718, highlighting the challenge of incomplete sanitization fixes in SCADA software. Coverage was picked up by vulnerability tracking services including Vulners, VulDB, INCIBE-CERT, and GitLab Advisories shortly after disclosure (FUXA Security Advisory, GitHub Advisory).