Sign in
Deutsch English Español Polski
High

FUXA contains an Unrestricted File Upload vulnerability

  • Disclosed: 03.02.2026
  • Updated: 11.10.2026 10:22

FUXA v1.2.7 contains an Unrestricted File Upload vulnerability in the /api/upload API endpoint. The endpoint lacks authentication mechanisms, allowing unauthenticated remote attackers to upload arbitrary files. This can be exploited to overwrite critical system files (such as the SQLite user database) to gain administrative access, or to upload malicious scripts to execute arbitrary code.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
npm package fuxa-server <= 1.2.7 no fix

References

CVSS score -
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
Weakness (CWE)
CWE-306, CWE-434
Platform
npm
Package
fuxa-server
Disclosed
03.02.2026
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-7g56-fwxj-cm23 - CC BY 4.0

Vulnerability history: fuxa-server

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (21) in the archive
Total entries
21
First → latest
09.2023 06.2026
Without a fix
9
Exploited in attacks
0

Severity breakdown

  • Critical 8
  • High 10
  • Medium 3

Disclosures per year

Severity:
  1. FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response reading
    High · 8.2 CVE-2026-47719 <= 1.1.14-1243 no fix
  2. FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations
    High · 7.5 CVE-2026-47717 >= 1.3.0, < 1.3.1 1.3.1
  3. FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass
    High CVE-2026-43947 >= 1.3.0, < 1.3.1 1.3.1
  4. FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue
    High CVE-2026-43946 >= 1.3.0, < 1.3.1 1.3.1
  5. FUXA Affected by a Path Traversal Sanitization Bypass
    High CVE-2026-25951 < 1.2.11 1.2.11
  6. FUXA Unauthenticated Remote Arbitrary Scheduler Write
    Critical CVE-2026-25939 >= 1.2.8, < 1.2.11 1.2.11
  7. FUXA Unauthenticated Remote Code Execution in Node-RED Integration
    Critical CVE-2026-25938 >= 1.2.8, < 1.2.11 1.2.11
  8. FUXA Unauthenticated Remote Arbitrary Device Tag Write
    Critical CVE-2026-25752 < 1.2.10 1.2.10
  9. FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API
    Critical CVE-2026-25895 < 1.2.10 1.2.10
  10. FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration
    Critical CVE-2026-25894 < 1.2.10 1.2.10
  11. FUXA Unauthenticated Exposure of Plaintext Database Credentials
    Critical CVE-2026-25751 < 1.2.10 1.2.10
  12. FUXA Unauthenticated Remote Code Execution via Admin JWT Minting
    Critical CVE-2026-25893 < 1.2.10 1.2.10
  13. FUXA allows Remote Code Execution (RCE) via the project import functionality.
    High · 9.8 CVE-2025-69983 <= 1.2.7 no fix
  14. FUXA contains an Unrestricted File Upload vulnerability this entry
    High CVE-2025-69981 <= 1.2.7 no fix
  15. FUXA contains an insecure default configuration vulnerability
    High CVE-2025-69970 <= 1.2.7 no fix
  16. FUXA SQL Injection vulnerability
    Critical · 9.8 CVE-2023-31719 <= 1.1.12 no fix
  17. FUXA local file inclusion vulnerability
    High · 7.5 CVE-2023-31718 <= 1.1.12 no fix
  18. FUXA SQL Injection vulnerability
    High · 7.5 CVE-2023-31717 <= 1.1.12 no fix

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.