CVE-2026-25895
CRITICALFUXA < 1.2.10 - Unauthenticated Path Traversal and Arbitrary File Write
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2026-25895. PoCs published by Anthony Cihan, adminlove520, Hann1bl3L3ct3r.
AI-analyzed exploit summary This exploit demonstrates an unauthenticated path traversal vulnerability in FUXA <= 1.2.9, allowing arbitrary file writes and remote code execution (RCE). The vulnerability stems from the `/api/upload` endpoint lacking authentication middleware and improperly handling the `destination` parameter, enabling directory traversal attacks.
Description
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. A path traversal vulnerability in FUXA allows an unauthenticated, remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10.
Exploits (3)
This exploit demonstrates an unauthenticated path traversal vulnerability in FUXA <= 1.2.9, allowing arbitrary file writes and remote code execution (RCE). The vulnerability stems from the `/api/upload` endpoint lacking authentication middleware and improperly handling the `destination` parameter, enabling directory traversal attacks.
The repository contains a functional Python exploit for CVE-2026-25895, targeting an unauthenticated path traversal vulnerability in FUXA <= 1.2.9. The exploit demonstrates arbitrary file write and remote code execution via multiple techniques, including cron job injection and webshell installation.
The repository contains a functional Python exploit for CVE-2026-25895, an unauthenticated path traversal vulnerability in FUXA <= 1.2.9. The exploit leverages a flawed endpoint to achieve arbitrary file writes and remote code execution via multiple post-exploitation techniques.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H