PT-2026-5980 · Fuxa · Fuxa

CVE-2025-69981 · Published 2026-02-03 · Updated 2026-02-11

Positive Technologies (AI Summary)

CVSS v4.0

8.1

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

Name of the Vulnerable Software and Affected Versions FUXA version 1.2.7

Description FUXA version 1.2.7 has an Unrestricted File Upload issue in the /api/upload API endpoint. The endpoint does not require authentication, which allows unauthenticated remote attackers to upload arbitrary files. Attackers can exploit this to overwrite critical system files, like the SQLite user database, to obtain administrative access, or upload malicious scripts to execute arbitrary code. The vulnerable parameter is the file uploaded to the /api/upload endpoint.

Recommendations Apply a fix or update to address the unrestricted file upload issue in the /api/upload API endpoint. Implement authentication mechanisms for the /api/upload endpoint to prevent unauthorized file uploads.

Exploit

Fix

Missing Authentication

Unrestricted File Upload

Weakness Enumeration

CWE-306

CWE-434

Related Identifiers

CVE-2025-69981

GHSA-7G56-FWXJ-CM23

Affected Products

Fuxa

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69981.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-69981 · Security Note
• https://osv.dev/vulnerability/CVE-2025-69981 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7g56-fwxj-cm23 · Vendor Advisory
• https://github.com/frangoteam/FUXA · Note
• https://github.com/frangoteam/FUXA/blob/master/server/api/projects/index.js#L193 · Note
• https://t.me/cveNotify/151570 · Telegram Post
• https://t.me/CVEtracker/43618 · Telegram Post
• https://t.me/cveNotify/151732 · Telegram Post