CVE-2025-69981

critical · 9.8

FUXA v1.2.7 contains an Unrestricted File Upload vulnerability in the `/api/upload` API endpoint. The endpoint lacks authentication mechanisms, allowing unauthenticated remote attackers to upload arbitrary files. This can be exploited to overwrite critical system files (such as the SQLite user database) to gain administrative access, or to upload malicious scripts to execute arbitrary code.

9.8

CVSS

0.8%

EPSS (exploit prob.)

54th

EPSS percentile

2026-02-03

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-434

Affected products

Vendor	Product	Affected versions
frangoteam	fuxa	1.2.7

Check a specific version with /api/v1/cve/match.

References

https://github.com/frangoteam/FUXA/blob/master/server/api/projects/index.js#L193

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-69981