CVE-2025-69981
Unrestricted File Upload in FUXA /api/upload Enables Remote Code Execution
Publication date: 2026-02-03
Last updated on: 2026-02-11
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| frangoteam | fuxa | 1.2.7 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in FUXA v1.2.7 is an Unrestricted File Upload issue found in the `/api/upload` API endpoint.
This endpoint does not have any authentication mechanisms, which means that anyone, including unauthenticated remote attackers, can upload files to the system.
Because of this, attackers can upload arbitrary files, potentially overwriting critical system files such as the SQLite user database or uploading malicious scripts that allow them to execute arbitrary code.
How can this vulnerability impact me? :
This vulnerability can have severe impacts including unauthorized administrative access and remote code execution.
- Attackers can overwrite critical system files like the SQLite user database, gaining administrative privileges.
- Malicious scripts can be uploaded and executed, potentially compromising the entire system.
- The lack of authentication on the upload endpoint makes it easy for attackers to exploit this vulnerability remotely without any credentials.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the `/api/upload` endpoint of FUXA v1.2.7 is accessible without authentication and allows file uploads.
You can use commands like curl to test the endpoint for unrestricted file upload capability.
- curl -X POST http://<target>/api/upload -F "[email protected]" -v
- Check the response to see if the upload is accepted without authentication.
- Additionally, monitor network traffic for POST requests to `/api/upload` from unauthenticated sources.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the `/api/upload` endpoint by implementing authentication and authorization controls.
You should also disable or restrict file uploads until a patch or update is applied.
Monitoring and blocking suspicious upload attempts and reviewing uploaded files for malicious content can help reduce risk.