by Kastro
Paper/Archive/CVE-2026-7411

CVE-2026-7411

Eclipse Foundation Eclipse BaSyx — In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path normalization in the Submodel HTTP API allows an u…

EPSS 4%public exploitCVSS 10.0
critical.is priorityof 100
58
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 89.7.897 × 2017.9Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path normalization in the Submodel HTTP API allows an unauthenticated remote attacker to perform a path traversal attack. By supplying a maliciously crafted fileName parameter during a file upload operation, an attacker can bypass intended storage boundaries and write arbitrary files to any location on the host filesystem accessible by the Java process. This can lead to Remote Code Execution (RCE) and complete system compromise.

Affected

ProductAffectedFixed inSource
Eclipse BaSyx< 2.0.0-milestone-102.0.0-milestone-10CNA

Scores by source

eclipse (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitgitlab.eclipse.org/security/vulnerability-reports/-/issues/423refgitlab.eclipse.org/security/cve-assignment/-/issues/102