PT-2026-37079 · Eclipse Foundation · Eclipse Basyx Java Server Sdk

Mohamed Lemine Ahmed Jidou · Published 2026-05-05 · Updated 2026-05-17 · CVE-2026-7411

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10

Description Inadequate path normalization in the Submodel HTTP API allows an unauthenticated remote attacker to perform a path traversal attack. By supplying a maliciously crafted fileName parameter during a file upload operation, an attacker can bypass intended storage boundaries and write arbitrary files to any location on the host filesystem accessible by the Java process. This can lead to Remote Code Execution (RCE), which is the ability to execute arbitrary commands on a target machine, and complete system compromise.

Recommendations Update to version 2.0.0-milestone-10 or later. Avoid using the fileName parameter in the Submodel HTTP API for file uploads until the update is applied.

Exploit

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-7411

GHSA-8GPM-H2MH-36QC

Affected Products

Eclipse Basyx Java Server Sdk

References · 15

• 🔥 https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/423 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7411 · Security Note
• https://ubuntu.com/security/CVE-2026-7411 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-7411 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-7411 · Security Note
• https://osv.dev/vulnerability/GHSA-8gpm-h2mh-36qc · Vendor Advisory
• https://github.com/eclipse-basyx/basyx-java-sdk · Note
• https://gitlab.eclipse.org/security/cve-assignment/-/issues/102 · Note
• https://twitter.com/NCIIPC/status/2051983081448632585 · Twitter Post
• https://twitter.com/ADKCyber/status/2056018607134417112 · Twitter Post
• https://twitter.com/lyrie_ai/status/2054863471498367333 · Twitter Post
• https://t.me/CVEtracker/52762 · Telegram Post
• https://twitter.com/lyrie_ai/status/2054863469778747882 · Twitter Post
• https://twitter.com/lyrie_ai/status/2054863470609285160 · Twitter Post
• https://reddit.com/r/AZURE/comments/1taoajk/eclipse_basyx_cve20267411_cve20267412_cvss_100 · Reddit Post