CVE-2026-25895
Published: 09 February 2026
Summary
CVE-2026-25895 is a critical-severity Path Traversal (CWE-22) vulnerability in Frangoteam Fuxa. Its CVSS base score is 9.5 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 16.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-25895 is a path traversal vulnerability (CWE-22, CWE-306) in FUXA, an open-source web-based Process Visualization (SCADA/HMI/Dashboard) software. The flaw enables an unauthenticated remote attacker to write arbitrary files to arbitrary locations on the affected server's filesystem. It impacts all versions of FUXA through 1.2.9 and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
An unauthenticated attacker with network access can exploit this vulnerability remotely with low complexity and no user interaction required. Successful exploitation allows full control over file writes on the server, potentially leading to remote code execution, data tampering, or complete system compromise depending on the attacker's privileges and the server's configuration.
The issue has been addressed in FUXA version 1.2.10, as detailed in the project's security advisory (GHSA-88qh-cphv-996c), release notes, and the patching commit. Security practitioners should upgrade to version 1.2.10 or later and review server filesystem permissions to mitigate risks in affected deployments.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-6244
Vulnerability details
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. A path traversal vulnerability in FUXA allows an unauthenticated, remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This affects FUXA through version 1.2.9. This issue has been…
more
patched in FUXA version 1.2.10.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal in public-facing web app enables unauthenticated remote arbitrary file write (T1190 exploitation) directly facilitating ingress of arbitrary files/tools (T1105) for RCE or further compromise.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the CVE by requiring timely patching to FUXA version 1.2.10 or later to remediate the path traversal flaw.
Prevents exploitation of path traversal by validating user-supplied inputs used in file path construction to block directory traversal sequences.
Boundary protection at web interfaces can filter and block path traversal payloads targeting the unauthenticated FUXA file write endpoint.