Path Traversal Vulnerability in FUXA Process Visualization Software
CVE-2026-25895
Key Information:
- Vendor
Frangoteam
- Status
- Vendor
- CVE Published:
- 9 February 2026
Badges
What is CVE-2026-25895?
FUXA, a web-based Process Visualization software, is vulnerable to a path traversal flaw that permits an unauthenticated attacker to write files to arbitrary locations on the server's filesystem. This allows malicious actors to potentially compromise server integrity and execute unauthorized actions. The vulnerability affects FUXA versions prior to 1.2.10, where it has been resolved. Users are urged to upgrade to the latest version to mitigate risks.
Affected Version(s)
FUXA < 1.2.10
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
News Articles
SwapupdateCVE-2026-25895Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets - SwapUpdate
Ravie LakshmananAug 18, 2026Vulnerability / Artificial Intelligence
The Hacker NewsCVE-2026-25895Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets
Attackers exploit MLflow CVE-2026-64849 via SSRF to steal cloud credentials, while FUXA CVE-2026-25895 draws malicious scanning.
References
EPSS Score
6% chance of being exploited in the next 30 days.
CVSS V4
Timeline
- 📰
First article discovered by The Hacker News
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved