CVE-2026-7411: Eclipse BaSyx Java Server SDK path traversal in Submodel HTTP API

CVE-2026-7411 · Severity: critical · CVSS 10 · Published 2026-05-05

The Eclipse BaSyx Java Server SDK, used for building Digital Twin infrastructures, contains a critical security flaw in its file upload handling. An unauthenticated attacker can exploit this to write malicious files to any location on the server's hard drive. This can lead to a complete takeover of the system, allowing the attacker to execute arbitrary commands, steal data, or disrupt industrial operations.

Technologies: Eclipse Foundation BaSyx Java Server SDK. Vendors: Eclipse Foundation, Maven.

Quick answers

Is CVE-2026-7411 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-7411 being exploited in the wild.
How severe is CVE-2026-7411?
Critical severity, with a CVSS score of 10, published 5 May 2026.
Which products and versions are affected?
Eclipse Foundation BaSyx Java Server SDK < 2.0.0-milestone-10; org.eclipse.basyx:basyx.sdk (Maven) < 2.0.0-milestone-10, ECOSYSTEM:introduced=0,fixed=2.0.0-milestone-10.
Is there a fix for CVE-2026-7411?
Yes. org.eclipse.basyx:basyx.sdk (Maven): upgrade to 2.0.0-milestone-10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-7411 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-7411?
Check whether you run Eclipse Foundation BaSyx Java Server SDK or org.eclipse.basyx:basyx.sdk (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.eclipse.basyx:basyx.sdk (Maven): upgrade to 2.0.0-milestone-10 or later
    # set org.eclipse.basyx:basyx.sdk to 2.0.0-milestone-10 in your pom.xml or build.gradle

Technical details

A path traversal vulnerability (CWE-22) exists in the Submodel HTTP API of the Eclipse BaSyx Java Server SDK. The root cause is inadequate path normalization of the 'fileName' parameter in the 'putFileByPath' method within 'SubmodelServiceHTTPApiController.java'. Because the application fails to sanitize directory traversal sequences (e.g., '../') before concatenating the filename with the storage directory, an unauthenticated remote attacker can bypass intended storage boundaries. By uploading a crafted file, an attacker can overwrite sensitive system files (such as cron jobs or SSH keys) to achieve persistent Remote Code Execution (RCE). This vulnerability is patched in version 2.0.0-milestone-10.

Affected products

  • Eclipse BaSyx Java Server SDK < 2.0.0-milestone-10

Identifiers

  • CVE-2026-7411
  • GHSA-8gpm-h2mh-36qc

Timeline

  • 2026-05-05: disclosed: Initial disclosure and NVD publication
  • 2026-05-05: advisory: GitHub Advisory published
  • 2026-05-11: patched: Advisory updated with patch information for version 2.0.0-milestone-10

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.