PT-2026-5980 · Fuxa · Fuxa

Published 2026-02-03 · Updated 2026-02-11 · CVE-2025-69981

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FUXA version 1.2.7

Description FUXA version 1.2.7 has an Unrestricted File Upload issue in the /api/upload API endpoint. The endpoint does not require authentication, which allows unauthenticated remote attackers to upload arbitrary files. Attackers can exploit this to overwrite critical system files, like the SQLite user database, to obtain administrative access, or upload malicious scripts to execute arbitrary code. The vulnerable parameter is the file uploaded to the /api/upload endpoint.

Recommendations Apply a fix or update to address the unrestricted file upload issue in the /api/upload API endpoint. Implement authentication mechanisms for the /api/upload endpoint to prevent unauthorized file uploads.

Fix

Unrestricted File Upload

Missing Authentication

Weakness Enumeration

CWE-434

CWE-306

Related Identifiers

CVE-2025-69981

GHSA-7G56-FWXJ-CM23

Affected Products

Fuxa

References · 8

• https://osv.dev/vulnerability/CVE-2025-69981 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-69981 · Security Note
• https://osv.dev/vulnerability/GHSA-7g56-fwxj-cm23 · Vendor Advisory
• https://github.com/frangoteam/FUXA · Note
• https://github.com/frangoteam/FUXA/blob/master/server/api/projects/index.js#L193 · Note
• https://t.me/cveNotify/151570 · Telegram Post
• https://t.me/CVEtracker/43618 · Telegram Post
• https://t.me/cveNotify/151732 · Telegram Post