A path traversal flaw in the FUXA upload API allows an unauthenticated, remote attacker to write files to arbitrary locations on the server. By using this vulnerability, an attacker can place malicious scripts or code that the web application will serve and later execute, effectively gaining full code execution control over the host. The weakness combines CWE‑22, which covers improper handling of paths, with CWE‑306, indicating missing authentication enforcement. The result is that any user who can reach the upload endpoint can compromise the entire system, undermining confidentiality, integrity, and availability.

The vulnerability exists in all releases of FUXA up to and including version 1.2.9. The affected product is the FUXA web‑based process visualization platform developed by frangoteam. Version 1.2.10 of the software contains a fix that addresses the path traversal flaw.

The CVSS score of 9.5 reflects the high severity and high impact of this flaw. Although the EPSS score is low (<1%), indicating that public exploitation is not common at the moment, the lack of authentication combined with the ability to write arbitrary files means that exploitation is straightforward once the API is reachable. The vulnerability is not listed in the CISA KEV catalog, but its remote nature and severe impact warrant immediate attention. Attackers could trigger the flaw via simple HTTP requests to the upload endpoint without needing valid credentials.