PT-2026-57990 · Mongodb+1 · Mongodb+1

Published 2026-07-14 · Updated 2026-07-14 · CVE-2026-57898

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 through 2.0.0-milestone-12

Description Deployments using the MongoDB backend are subject to an unauthenticated arbitrary file write via the AAS thumbnail API. The issue occurs because the thumbnail upload path accepts a client-controlled fileName request parameter, which is used as a repository key and later as a local filesystem path during retrieval. When using the MongoDB file repository, the fileName is treated as an opaque GridFS key and is not normalized or restricted. A remote attacker can upload content using an absolute or traversal-style filename and trigger retrieval to write bytes to an arbitrary path on the server filesystem where the Java process has write permissions, potentially leading to remote code execution.

Recommendations Update to version 2.0.0-milestone-13.

Fix

Path traversal

Weakness Enumeration

CWE-73

CWE-22

Related Identifiers

CVE-2026-57898

Affected Products

Eclipse Basyx Java Server Sdk

Mongodb

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-57898 · Security Note
• https://gitlab.eclipse.org/security/cve-assignment/-/work_items/159 · Note
• https://twitter.com/CVEnew/status/2076980603904246177 · Twitter Post
• https://twitter.com/infoflowcloud/status/2076981543113814094 · Twitter Post