Executive brief
The Eclipse BaSyx Java Server SDK, used for building Digital Twin infrastructures, contains a critical security flaw in its file upload handling. An unauthenticated attacker can exploit this to write malicious files to any location on the server's hard drive. This can lead to a complete takeover of the system, allowing the attacker to execute arbitrary commands, steal data, or disrupt industrial operations.
Technical details
A path traversal vulnerability (CWE-22) exists in the Submodel HTTP API of the Eclipse BaSyx Java Server SDK. The root cause is inadequate path normalization of the 'fileName' parameter in the 'putFileByPath' method within 'SubmodelServiceHTTPApiController.java'. Because the application fails to sanitize directory traversal sequences (e.g., '../') before concatenating the filename with the storage directory, an unauthenticated remote attacker can bypass intended storage boundaries. By uploading a crafted file, an attacker can overwrite sensitive system files (such as cron jobs or SSH keys) to achieve persistent Remote Code Execution (RCE). This vulnerability is patched in version 2.0.0-milestone-10.
Affected products
- Eclipse BaSyx Java Server SDK < 2.0.0-milestone-10
Timeline
- 2026-05-05: disclosed: Initial disclosure and NVD publication
- 2026-05-05: advisory: GitHub Advisory published
- 2026-05-11: patched: Advisory updated with patch information for version 2.0.0-milestone-10