CVE-2026-25951: FUXA Server Path Traversal Sanitization Bypass Vulnerability
Summary
CVE-2026-25951: FUXA Affected by a Path Traversal Sanitization Bypass. Affects fuxa-server versions < 1.2.11. Fixed in 1.2.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
FUXA is an open-source server package designed for managing and processing various functionalities within applications. It provides endpoints for file uploads, resource management, and logging. However, it has been found to have a critical vulnerability that allows authenticated attackers with administrative privileges to bypass directory traversal protections, potentially leading to severe security risks.
Vulnerability Detail
The vulnerability arises from a flaw in the path sanitization logic of the FUXA server. This flaw allows attackers to use nested traversal sequences (e.g., ....//) to bypass protections and write arbitrary files to the server's filesystem. This can include sensitive directories, leading to Remote Code Execution (RCE) when the server reloads malicious scripts. The vulnerability represents a regression from previous fixes, expanding its impact across multiple critical endpoints beyond just /api/download, including /api/upload, /api/resources/remove, and /api/logs.
How To Fix
Latest published version: 1.1.14-1243 as of 23 Oct 2026
npm install fuxa-server@1.1.14-1243Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.2.11
This is the first release that contains the fix.
npm install fuxa-server@1.2.11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the affected endpoints (/api/upload, /api/resources/remove, /api/logs) for users without administrative privileges until the package can be updated.
Conclusion
The CVE-2026-25951 vulnerability in the FUXA server poses significant risks due to its ability to bypass path traversal protections, leading to potential Remote Code Execution. It is crucial for users to update to the patched version 1.2.11 or later and implement temporary access restrictions to mitigate risks.
See every vulnerability recorded for fuxa-server →
FAQ
CVE-2026-25951 is a vulnerability in the FUXA server that allows authenticated attackers to bypass path traversal protections, potentially leading to Remote Code Execution.
Any application using FUXA server versions 1.2.10 and below is affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The vulnerability can lead to Remote Code Execution, allowing attackers to gain full control over the system, disrupt operations, and compromise data integrity.
If immediate updates are not possible, restrict access to the affected endpoints as a temporary measure until the patch can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for fuxa-server.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
