Loading vulnerability…
CVE-2026-25895 is a critical vulnerability in FUXA, a web-based SCADA/HMI/dashboard platform, affecting versions through 1.2.9. The flaw is caused by a missing authentication check on a critical upload function combined with path traversal in the upload destination handling. In vulnerable versions, the upload endpoint can be reached without authentication, and attacker-controlled path input is resolved without sufficient containment validation, allowing traversal outside the intended application directory. As a result, a remote unauthenticated attacker can write arbitrary files to arbitrary locations on the server filesystem. Because the primitive permits overwriting application code, configuration, startup material, or other executable content, the issue can be leveraged beyond file corruption and may lead to remote code execution.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository is a small standalone exploit repo containing one Python exploit script (fuxapwn.py) and one README. It targets CVE-2026-25895 in frangoteam FUXA <= 1.2.9, a Node.js-based SCADA/HMI platform. The vulnerability is an unauthenticated path traversal in POST /api/upload that enables arbitrary file write outside the intended application directory because the destination field is resolved into a filesystem path without proper normalization/containment checks and the route lacks authentication middleware. Repository structure is simple: README.md documents the vulnerability, impact, usage modes, and mitigation; fuxapwn.py is the operational exploit entry point with argparse-based CLI handling and a class wrapping the vulnerable upload primitive. The script uses Python requests as its only external dependency and appears designed for direct operator use rather than integration into a larger framework. Main exploit capabilities include: pre-auth arbitrary file write; reconnaissance using server error behavior to infer filesystem/user information; canary writes to benign paths; cron-based RCE by dropping files into /etc/cron.d when privileges permit; replacement of settings.js to gain code execution on FUXA restart; deployment of an in-process HTTP webshell with configurable host/port/path/token; interactive command execution against that webshell; and SSH authorized_keys persistence. The code also contains helper routines to parse JSON error responses and extract errno/syscall details, indicating the exploit leverages server-side filesystem error messages as a side channel during recon. This is a real exploit, not just a detector. It is network-reachable over HTTP/HTTPS, requires no authentication, and provides practical post-exploitation options. Because payloads are built into the script but are relatively direct and operator-driven, the maturity is best classified as OPERATIONAL rather than framework-weaponized.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical FUXA vulnerability caused by missing authentication for a critical function combined with path traversal, allowing unauthenticated remote attackers to write arbitrary files and potentially achieve remote code execution.
A missing authentication and path traversal vulnerability in FUXA that allows unauthenticated remote arbitrary file write and can lead to remote code execution.
An unauthenticated path traversal vulnerability in FUXA version 1.2.9 and earlier that can lead to arbitrary file write.
A pre-auth path traversal and arbitrary file write vulnerability in FUXA's /api/upload endpoint due to missing authentication and unsafe path resolution, enabling remote code execution through file placement and post-exploitation techniques.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.