Executive brief
SW360 is a component and license management system used by enterprises to track open-source software. When configured to store file attachments on the local file system, an attacker can upload files with specially crafted filenames to write files to arbitrary locations on the server, potentially overwriting critical system files or gaining code execution.
Technical details
The vulnerability is a path traversal flaw in SW360's attachment upload handler when the enable.attachment.store.to.file.system configuration option is enabled. An attacker can manipulate the filename parameter during file upload to include directory traversal sequences (e.g., ../) and thus write files to arbitrary paths on the server filesystem. No authentication bypass is required if file upload endpoints are accessible. The attack allows arbitrary file write, which could lead to remote code execution if executable locations are writable. Patches have been merged into the releases/20 and releases/20.1 branches as of August 2026.
Affected products
- Eclipse SW360 19.0.0, 19.1.0, 19.2.0, 20.0.0, 20.1.0
Timeline
- 2026-08-27: disclosed
- 2026-08-21: patched: Patches merged into releases/20 and releases/20.1 branches