FUXA Affected by a Path Traversal Sanitization Bypass

The impact of CVE-2026-25951 is significant due to the potential for Remote Code Execution. An attacker, having administrative privileges, can exploit this vulnerability by crafting malicious requests with nested traversal sequences (e.g., '....//'). This allows them to write arbitrary files to the server's filesystem, including sensitive directories like runtime/scripts. If the server reloads these malicious scripts, the attacker can execute arbitrary code with the privileges of the fuxa-server process. This could lead to complete system compromise, data exfiltration, or denial of service. The ability to write to the runtime/scripts directory is particularly concerning, as it directly impacts the server's core functionality.

Organizations relying on fuxa-server for critical services are at risk, particularly those with administrative interfaces exposed to the internet. Environments with legacy configurations or shared hosting setups where user privileges are not strictly controlled are especially vulnerable. Any deployment using older, unpatched versions of fuxa-server is potentially exposed.

• nodejs / server:

journalctl -u fuxa-server -f | grep -i "path traversal"

• nodejs / server:

ps aux | grep fuxa-server | grep -i "....//"

• generic web: Use curl to test for path traversal:

curl 'http://your-fuxa-server/path/....//sensitive_file.txt' 

• generic web: Grep access logs for requests containing suspicious path traversal sequences (e.g., '....//').

1. 2026-02-10Disclosure

   disclosure

1. Reserviert2026-02-09
2. Veröffentlicht2026-02-10
3. Geändert2026-02-22
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-25951 is to upgrade fuxa-server to version 1.2.11 or later. If an immediate upgrade is not feasible, consider implementing temporary workarounds. Restrict administrative access to the fuxa-server to only trusted users. Implement strict input validation and sanitization on all user-supplied data, particularly file paths. Consider using a Web Application Firewall (WAF) with rules to detect and block malicious path traversal attempts. Monitor server logs for suspicious activity, such as attempts to access or modify files outside of expected directories. After upgrading, confirm the fix by attempting a path traversal attack and verifying that it is blocked.