GitHub Advisoryadvisory · npm

GHSA-7g56-fwxj-cm23 FUXA contains an Unrestricted File Upload vulnerability

HIGH Published 2026-02-03 Modified 2026-02-04 Official page ↗
Aliases
CVE-2025-69981
Ecosystem
npm
Packages
fuxa-server
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
Weaknesses
CWE-306, CWE-434
Reviewed
2026-02-04

Affected packages

• npm fuxa-server: <= 1.2.7 (no fix yet)

Description

FUXA v1.2.7 contains an Unrestricted File Upload vulnerability in the `/api/upload` API endpoint. The endpoint lacks authentication mechanisms, allowing unauthenticated remote attackers to upload arbitrary files. This can be exploited to overwrite critical system files (such as the SQLite user database) to gain administrative access, or to upload malicious scripts to execute arbitrary code.

Related

Alias · CVE (1)

  • CVE-2025-69981 FUXA v1.2.7 contains an Unrestricted File Upload vulnerability in the `/api/upload` API endpoint. vulnerability

Weakness · CWE (2)

  • CWE-306 Missing Authentication for Critical Functionality weakness
  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References