CVE-2026-7411 Eclipse BaSyx Java Server SDK vulnerable to Path Traversal
Unauthenticated attackers can exploit path traversal in the Submodel HTTP API to write arbitrary files, leading to remote code execution and system compromise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-7411?
CVE-2026-7411 is a critical path traversal vulnerability in Eclipse BaSyx, published on 5 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path normalization in the Submodel HTTP API allows an unauthenticated remote attacker to perform a path traversal attack. By supplying a maliciously crafted fileName parameter during a file upload operation, an attacker can bypass intended storage boundaries and write arbitrary files to any location on the host filesystem accessible by the Java process. This can lead to Remote Code Execution (RCE) and complete system compromise.
Weakness: CWE-22
Which versions are affected by CVE-2026-7411?
2 open source packages ship an affected version, including org.eclipse.basyx:basyx.sdk.
| Package | Affected | Fixed in |
|---|---|---|
org.eclipse.basyx:basyx.sdk Maven | All versions | 2.0.0-milestone-10 |
org.eclipse.basyx:basyx.sdk Maven | All versions | 2.0.0-milestone-10 |
How do I fix CVE-2026-7411?
Upgrade org.eclipse.basyx:basyx.sdk to 2.0.0-milestone-10 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-7411 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-7411 exists.
Sources
Also known as GHSA-8gpm-h2mh-36qc.