Path Traversal Vulnerability in Eclipse BaSyx Java Server SDK

CVE-2026-7411

What is CVE-2026-7411?

In certain versions of the Eclipse BaSyx Java Server SDK, a vulnerability exists that allows unauthenticated attackers to exploit inadequate path normalization in the Submodel HTTP API. Attackers can perform a path traversal attack by manipulating the fileName parameter during file uploads. This exploit enables them to bypass storage boundaries, potentially writing arbitrary files to any location within the host filesystem that is accessible by the Java process. Such an attack can result in unauthorized Remote Code Execution (RCE), posing severe risks to system integrity.

References