CVE-2026-25895CWE-22CWE-306

FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API

Critical · published February 9, 2026

CVSS v4.0
9.5
EPSS
7%
Percentile
94.1
In the wild
Unconfirmed
What it is

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. A path traversal vulnerability in FUXA allows an unauthenticated, remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10.

The record
Technical detail
CVSS v4.0
9.5 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.06924 · 94.1th percentile
Weaknesses
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-306 · Missing Authentication for Critical Function
Published
2026-02-09T22:29Z
EPSS history
Timeline
  • 09 FEB 22:29Z
    FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API
    cvelistv5