CVE-2026-7411
published 2026-05-05CVE-2026-7411: In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path normalization in the Submodel HTTP API allows an unauthenticated remote…
PriorityP279critical10CVSS 3.1
AVNACLPRNUINSCCHIHAH
EPSS
3.68%
88.3th percentile
In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path normalization in the Submodel HTTP API allows an unauthenticated remote attacker to perform a path traversal attack. By supplying a maliciously crafted fileName parameter during a file upload operation, an attacker can bypass intended storage boundaries and write arbitrary files to any location on the host filesystem accessible by the Java process. This can lead to Remote Code Execution (RCE) and complete system compromise.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| eclipse_foundation | eclipse_basyx | < 2.0.0-milestone-10 | 2.0.0-milestone-10 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Eclipse BaSyx up to 2.0.0-milestone-9 Submodel HTTP API fileName path traversal (Issue 102)
vuldb·2026-05-05·CVSS 10.0
CVE-2026-7411 [CRITICAL] Eclipse BaSyx up to 2.0.0-milestone-9 Submodel HTTP API fileName path traversal (Issue 102)
A vulnerability marked as critical has been reported in Eclipse BaSyx up to 2.0.0-milestone-9. This issue affects some unknown processing of the component Submodel HTTP API. The manipulation of the argument fileName leads to path traversal.
This vulnerability is documented as CVE-2026-7411. The attack can be initiated remotely. There is not any exploit available.
It is suggested to upgrade the affected component.
GHSA
Eclipse BaSyx Java Server SDK vulnerable to Path Traversal
ghsa·2026-05-05
CVE-2026-7411 [CRITICAL] CWE-22 Eclipse BaSyx Java Server SDK vulnerable to Path Traversal
Eclipse BaSyx Java Server SDK vulnerable to Path Traversal
In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path normalization in the Submodel HTTP API allows an unauthenticated remote attacker to perform a path traversal attack. By supplying a maliciously crafted fileName parameter during a file upload operation, an attacker can bypass intended storage boundaries and write arbitrary files to any location on the host filesystem accessible by the Java process. This can lead to Remote Code Execution (RCE) and complete system compromise.
GHSA
GHSA-8gpm-h2mh-36qc: In Eclipse BaSyx Java Server SDK versions prior to 2
ghsa_unreviewed·2026-05-05
CVE-2026-7411 [CRITICAL] CWE-22 GHSA-8gpm-h2mh-36qc: In Eclipse BaSyx Java Server SDK versions prior to 2
In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path normalization in the Submodel HTTP API allows an unauthenticated remote attacker to perform a path traversal attack. By supplying a maliciously crafted fileName parameter during a file upload operation, an attacker can bypass intended storage boundaries and write arbitrary files to any location on the host filesystem accessible by the Java process. This can lead to Remote Code Execution (RCE) and complete system compromise.
No detection rules found.
No public exploits indexed.
2026-05-05
Published