Skip to main content
ExploitPublished

https://github.com/frangoteam/FUXA · FUXA 1.2.9 · RCE

Affects https://github.com/frangoteam/FUXASource Exploit-DB RSS Feed

0
Severity
Medium

Rated by Threat Radar

Data as of 18 Jun 2026, 21:48 UTC

What to do

Affected software

ProductAffectedFixed in
https://github.com/frangoteam/FUXAAffected
  • <=1.2.9
Fixed in–

AI-suggested

Until an official fix is released, users should consider restricting access to the FUXA service, applying network-level protections, or disabling the service if feasible to reduce exposure.

Description

FUXA 1.2.9 - RCE

Indicators of compromise

Exploit source code

Exploit code for FUXA 1.2.9 - RCE72,583 characters
# Exploit Title: FUXA  1.2.9 -  RCE
# Date: 4/24/2026
# Exploit Author: Anthony Cihan (Hann1bl3L3ct3r)
# Vendor Homepage: https://github.com/frangoteam/FUXA
# Version: <= 1.2.9 
# Tested on: Ubuntu Server 
# CVE : CVE-2026-25895

"""
CVE-2026-25895 - FUXA Unauthenticated Path Traversal -> Arbitrary File Write -> RCE
Affected: FUXA <= 1.2.9
Patched:  1.2.10

Vulnerable endpoint: POST /api/upload (server/api/projects/index.js, ~line 193)
Root cause:
  * The /api/upload route is registered with NO …

References

Community reviews

Loading reviews…