CVE-2026-25895 is a path traversal flaw in FUXA through version 1.2.9, rated 9.8. An unauthenticated remote attacker can write files to arbitrary locations on the server filesystem, even when authentication is on. Version 1.2.10 fixes it. Upgrade, and check the server for files you did not put there.
What's affected
- Package: fuxa-server on npm (FUXA, the web based SCADA, HMI and dashboard software).
- Affected: versions through 1.2.9.
- Fixed: 1.2.10, and the same release closes the other FUXA CVEs in this series.
- Weakness: path traversal leading to arbitrary file write without authentication.
How to check if you're exposed
Find the FUXA version in each deployment, and then check who can reach it:
npm ls fuxa-server
docker ps --format '{{.Image}}' | grep -i fuxa
A SCADA or HMI web interface should never be reachable from the internet. Test from outside your plant network that the FUXA port does not answer.
What to do now
- Upgrade FUXA to 1.2.10 or later.
- Take FUXA off the public internet and place it behind a VPN or a segmented network.
- Check the file system for recently modified application, startup and configuration files, and compare them against a known good copy.
- Run FUXA as an unprivileged user that cannot write outside its own data directory.
- Review logs and project files for changes you did not make, and check connected device configurations with your process engineers.
- Plan the upgrade with operations staff, since FUXA sits next to physical equipment.
Why it matters
The record lists CWE-22, path traversal, and CWE-306, missing authentication. The advisory says all deployments are affected, including those with authentication enabled, and that an attacker could overwrite application and system files.
If the attacker can replace code, startup scripts or configuration that is later loaded, remote code execution is likely, as the advisory notes. The advisory also explains how this differs from an earlier file upload CVE that sits behind a login. The record does not mark this CVE as exploited in the wild.
Quick check
Why does a file write become code execution?
Overwriting a script, config or code file that the system runs later turns data into instructions. Least privilege limits what an attacker can overwrite.
Sources
Last reviewed: 19 October 2026.
