CVE-2025-69981: FUXA Server Unrestricted File Upload Vulnerability
Summary
CVE-2025-69981: FUXA contains an Unrestricted File Upload vulnerability. Affects fuxa-server versions < 1.2.7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FUXA is an open-source server application designed for file management and data handling, primarily used in web applications. It allows users to upload files through its API endpoints. However, the version 1.2.7 of FUXA contains a critical vulnerability that exposes the system to unauthorized file uploads, potentially compromising the server's integrity.
Vulnerability Detail
FUXA v1.2.7 has an Unrestricted File Upload vulnerability in the /api/upload API endpoint. This endpoint lacks proper authentication mechanisms, allowing unauthenticated attackers to upload arbitrary files. This vulnerability can be exploited to overwrite critical system files, such as the SQLite user database, leading to unauthorized administrative access or the execution of malicious scripts on the server.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, implement authentication mechanisms for the /api/upload endpoint to restrict access to authorized users only. This can be done by adding middleware to check for valid user sessions before allowing file uploads.
Conclusion
The Unrestricted File Upload vulnerability in FUXA v1.2.7 poses a serious threat to server security, allowing unauthorized file uploads that can lead to data breaches and system compromise. It is crucial to update to a patched version and implement proper authentication to safeguard your application.
See every vulnerability recorded for fuxa-server →
FAQ
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Attackers can upload any arbitrary files, including potentially malicious scripts that can execute code on the server.
Yes, there is a significant risk of data loss as attackers can overwrite critical system files, including databases.
If you cannot update the package immediately, implement authentication on the upload endpoint as a temporary measure to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for fuxa-server.
