Description
A flaw in the path sanitization logic allows an authenticated attacker with administrative privileges to bypass directory traversal protections. By using nested traversal sequences (e.g., ….//), an attacker can write arbitrary files to the server filesystem, including sensitive directories like runtime/scripts.
Recommendation
Update the fuxa-server package to the latest compatible version. Followings are version details:
- Affected version(s): <= 1.2.10
- Patched version(s): 1.2.11
References
- GHSA-68m5-5w2h-h837
- CVE-2026-25951
- CWE-184
- CWE-22
- CWE-23
- CAPEC-310
- OWASP 2021-A1
- OWASP 2021-A3
- OWASP 2021-A6
Related Issues
- ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction - CVE-2026-32731
- SignalK Server has Path Traversal leading to information disclosure - CVE-2026-25228
- liquidjs has a path traversal fallback vulnerability - CVE-2026-30952
- FUXA Unauthenticated Exposure of Plaintext Database Credentials - CVE-2026-25751
- Tags:
- npm
- fuxa-server
Anything's wrong? Let us know Last updated on February 10, 2026