PT-2026-6387 · Npm · Fuxa-Server

Published 2026-02-03 · Updated 2026-02-03

OSV

CVSS v4.0

8.1

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

FUXA v1.2.7 contains an Unrestricted File Upload vulnerability in the /api/upload API endpoint. The endpoint lacks authentication mechanisms, allowing unauthenticated remote attackers to upload arbitrary files. This can be exploited to overwrite critical system files (such as the SQLite user database) to gain administrative access, or to upload malicious scripts to execute arbitrary code.

Fix

Missing Authentication

Unrestricted File Upload

Weakness Enumeration

CWE-306

CWE-434

Related Identifiers

GHSA-7G56-FWXJ-CM23

Affected Products

Fuxa-Server

References · 4

• https://osv.dev/vulnerability/GHSA-7g56-fwxj-cm23 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-69981 · Security Note
• https://github.com/frangoteam/FUXA · Note
• https://github.com/frangoteam/FUXA/blob/master/server/api/projects/index.js#L193 · Note