A critical unauthenticated remote code execution vulnerability in the FUXA SCADA platform could let attackers take full control of affected servers — no credentials needed.
The bug, tracked as CVE-2026-25895, affects FUXA versions up to and including 1.2.9. It was discovered by Anthony Cihan and disclosed in April 2026. A patch arrived in version 1.2.10.
The root cause is a path traversal in the POST /api/upload endpoint. The route is registered with no authentication middleware, bypassing both JWT and API-key checks that protect every other endpoint in the application. Inside the handler, the destination field from the JSON body gets concatenated into a file path with only a leading underscore and no normalization or containment check.
An attacker can supply a relative payload like a/../../../../target to climb out of the application directory and write files anywhere the FUXA process has access. That means pre-auth RCE even when security features are explicitly enabled.
If you’re running FUXA in production — especially internet-facing — patch to 1.2.10 immediately. This is about as bad as it gets for an unauthenticated attack surface.
