Executive brief
Eclipse BaSyx is a software toolkit used to implement digital twins in industrial manufacturing. A security flaw in certain versions using a MongoDB database allows an unauthenticated attacker to write malicious files to the server's filesystem. This could lead to a complete system takeover, data loss, or service disruption.
Technical details
A path traversal vulnerability (CWE-22) exists in the AAS thumbnail API of the Eclipse BaSyx Java Server SDK when configured with a MongoDB backend. The application accepts a client-controlled 'fileName' parameter during thumbnail upload and fails to normalize or restrict it before using it as a filesystem path during retrieval. An unauthenticated remote attacker can upload malicious bytes with a traversal-style filename and then trigger a retrieval request to write that content to an arbitrary location on the server. This can be leveraged to achieve remote code execution (RCE) by overwriting critical system or application files. The issue is resolved in version 2.0.0-milestone-13.
Affected products
- Eclipse Foundation BaSyx Java Server SDK 2.0.0-milestone-05 to 2.0.0-milestone-12
Timeline
- 2026-07-14: advisory: NVD publication date
- 2026-07-14: disclosed: Public disclosure via Eclipse Foundation GitLab
- 2026-07-14: patched: Fixed in version 2.0.0-milestone-13