PT-2026-6387 · Npm · Fuxa-Server

Published 2026-02-03 · Updated 2026-02-03

OSV

CVSS v4.0

8.1

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

FUXA v1.2.7 contains an Unrestricted File Upload vulnerability in the /api/upload API endpoint. The endpoint lacks authentication mechanisms, allowing unauthenticated remote attackers to upload arbitrary files. This can be exploited to overwrite critical system files (such as the SQLite user database) to gain administrative access, or to upload malicious scripts to execute arbitrary code.

Fix

Unrestricted File Upload

Missing Authentication

Weakness Enumeration

CWE-434

CWE-306

Related Identifiers

GHSA-7G56-FWXJ-CM23

Affected Products

Fuxa-Server

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-69981 · Security Note
• https://osv.dev/vulnerability/GHSA-7g56-fwxj-cm23 · Vendor Advisory
• https://github.com/frangoteam/FUXA · Note
• https://github.com/frangoteam/FUXA/blob/master/server/api/projects/index.js#L193 · Note