critical9.8
CVE-2025-69983
FUXA allows Remote Code Execution (RCE) via the project import functionality.
Impact
FUXA v1.2.7 allows Remote Code Execution (RCE) via the project import functionality. The application does not properly sanitize or sandbox user-supplied scripts within imported project files. An attacker can upload a malicious project containing system commands, leading to full system compromise.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | fuxa-server | <= 1.2.7 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Frangoteam | Fuxa | Version 1.2.7 |