CVE-2025-69981 is a critical flaw (CVSS 9.8) in FUXA 1.2.7. The /api/upload endpoint needs no authentication and accepts arbitrary files, which can overwrite system files such as the user database or place scripts. The record names no fixed version. Check the FUXA project.
What's affected
- FUXA v1.2.7, confirmed in the record.
- Affected endpoint: /api/upload, in server/api/projects/index.js.
- Fixed version: not stated in the record. Check the FUXA repository.
How to check if you're exposed
Confirm the FUXA version. For 1.2.7, treat the upload endpoint as open. Check network reachability of the web port from outside the plant or building network.
Also look at the host: modified timestamps on the FUXA data folder and the user database, and unexpected new files in the application directories, are signs that something was uploaded.
What to do now
- Inventory FUXA servers and versions.
- Upgrade to a release that fixes the endpoint if the project has published one.
- Block /api/upload at a reverse proxy for unauthenticated clients if you cannot upgrade yet.
- Keep the service off the internet.
- Back up the FUXA data folder and compare it with a known good copy.
- Run the service under a low privilege account with write access only to its own folders.
A reverse proxy rule that blocks the upload route for unauthenticated clients is a stopgap, not a fix, and it needs testing. Take a backup of the application data before you change anything, so you have a known good copy to compare against if you suspect tampering.
Why it matters
The weakness is CWE-434, unrestricted upload of a file with a dangerous type. Two controls are missing: no check on who is uploading, and no check on what the file is or where it is saved.
The record explains the consequence. Overwriting the SQLite user database could grant administrative access, and uploading a script could lead to code execution. SCADA tools control physical equipment, so this goes beyond data. This is one of three FUXA 1.2.7 CVEs published together. The record does not list it as exploited in the wild.
Quick check
What is at risk from an open upload endpoint?
Files on the server can be overwritten, including the user database, and scripts can be placed, which the record says can lead to admin access or code execution.
Sources
Last reviewed: 19 October 2026.
