GHSA-88qh-cphv-996c: FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API

February 5, 2026

Description A Path Traversal vulnerability in FUXA allows an unauthenticated, remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10.

References

github.com/advisories/GHSA-88qh-cphv-996c
github.com/frangoteam/FUXA
github.com/frangoteam/FUXA/commit/22c2192f5d9beef8a787c45eff3a14c24dbb5f96
github.com/frangoteam/FUXA/security/advisories/GHSA-88qh-cphv-996c

Code Behaviors & Features

Detect and mitigate GHSA-88qh-cphv-996c with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →