PT-2026-6387 · Npm · Fuxa-Server

Publicado 2026-02-03 · Atualizado 2026-02-03

OSV

CVSS v4.0

8.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

FUXA v1.2.7 contains an Unrestricted File Upload vulnerability in the /api/upload API endpoint. The endpoint lacks authentication mechanisms, allowing unauthenticated remote attackers to upload arbitrary files. This can be exploited to overwrite critical system files (such as the SQLite user database) to gain administrative access, or to upload malicious scripts to execute arbitrary code.

Correção

Missing Authentication

Unrestricted File Upload

Enumeração de Fraquezas

CWE-306

CWE-434

Identificadores relacionados

GHSA-7G56-FWXJ-CM23

Produtos afetados

Fuxa-Server

Referências · 4

• https://github.com/frangoteam/FUXA · Nota
• https://github.com/frangoteam/FUXA/blob/master/server/api/projects/index.js#L193 · Nota
• https://osv.dev/vulnerability/GHSA-7g56-fwxj-cm23 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-69981 · Nota de Segurança