CVE-2025-69981

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-69981
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-69981.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-69981
Aliases
Published
2026-02-03T00:00:00Z
Modified
2026-07-15T01:49:21.707329144Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

FUXA v1.2.7 contains an Unrestricted File Upload vulnerability in the /api/upload API endpoint. The endpoint lacks authentication mechanisms, allowing unauthenticated remote attackers to upload arbitrary files. This can be exploited to overwrite critical system files (such as the SQLite user database) to gain administrative access, or to upload malicious scripts to execute arbitrary code.

Database specific 
{
    "cna_assigner": "mitre",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69981.json"
}
References

Affected packages

Git / github.com/frangoteam/fuxa

Affected ranges

Type
GIT
Repo
https://github.com/frangoteam/fuxa
Events
Introduced
bbd738d21d7192d5eaaf58577de68eced4a609eb
Last affected
bbd738d21d7192d5eaaf58577de68eced4a609eb
Database specific 
{
    "source": "CPE_STRING",
    "cpe": "cpe:2.3:a:frangoteam:fuxa:1.2.7:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.2.7"
        },
        {
            "last_affected": "1.2.7"
        }
    ]
}

Affected versions

1.*
1.2.7
v1.*
v1.2.7

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-69981.json"