CVE-2026-7411: Path Traversal
In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path normalization in the Submodel HTTP API allows an unauthenticated remote attacker to perform a path traversal attack. By supplying a maliciously crafted fileName parameter during a file upload operation, an attacker can bypass intended storage boundaries and write arbitrary files to any location on the host filesystem accessible by the Java process. This can lead to Remote Code Execution (RCE) and complete system compromise.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Eclipse BaSyx Java Server SDKto a version that resolves this vulnerability.Fixed in 2.0.0-milestone-10 - Compensating control
Because the issue is exploitable via the Submodel HTTP API using an unauthenticated remote path traversal attack, restrict network access to the BaSyx Submodel HTTP API endpoint so it is not reachable by unauthenticated clients (e.g., only allow access from trusted IPs or through an authenticated gateway/WAF).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7411?
CVE-2026-7411 is classified as a high severity vulnerability due to the potential for unauthenticated remote exploitation.
How do I fix CVE-2026-7411?
To fix CVE-2026-7411, upgrade to Eclipse BaSyx Java Server SDK version 2.0.0-milestone-10 or later.
What kind of attack can be performed using CVE-2026-7411?
CVE-2026-7411 allows attackers to perform a path traversal attack during file upload operations.
Which versions of Eclipse BaSyx Java Server SDK are affected by CVE-2026-7411?
CVE-2026-7411 affects all versions of Eclipse BaSyx Java Server SDK prior to 2.0.0-milestone-10.
Is authentication required to exploit CVE-2026-7411?
No, CVE-2026-7411 can be exploited by unauthenticated remote attackers.