CVE-2026-7411: Eclipse BaSyx Java Server SDK Path Traversal in Submodel API
CVE-2026-7411 is a path traversal flaw (CWE-22) in the Submodel HTTP API of Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10. According to the CNA, an unauthenticated remote attacker can abuse the fileName parameter during file upload to write files outside the intended storage area, which may lead to remote code execution. The record carries a CVSS 3.1 base score of 10 from the CNA, is not listed in CISA KEV, and lists no affected or fixed versions yet.
Overview
CVE-2026-7411 affects the Submodel HTTP API of the Eclipse BaSyx Java Server SDK. The CNA describes inadequate path normalization during file upload, where the fileName parameter can place data outside the intended storage directory. The issue is classified as CWE-22 (Path Traversal).
Impact
The CNA states that an unauthenticated remote attacker could write arbitrary files to any location the Java process can access on the host. The record states this can lead to remote code execution and complete system compromise. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H is reported by the CNA with a base score of 10.
- Confidentiality, integrity and availability are all rated high in the vector.
- No authentication or user interaction is required according to the vector.
- The scope is changed, which means impact may extend beyond the vulnerable component.
Affected products and versions
The record describes versions prior to 2.0.0-milestone-10 of the Eclipse BaSyx Java Server SDK. The structured affected list is empty in the record, so the exact set of affected version ranges should be confirmed with the vendor and the Eclipse security references.
Exploitation status
The CISA KEV catalog does not list this CVE in the data consulted. No confirmed exploitation appears in the sources consulted. The EPSS record shows a probability of 0.0152 with a percentile of 0.73929, which is a statistical estimate and not evidence of exploitation.
Remediation and mitigation
- Identify all deployments of the Eclipse BaSyx Java Server SDK and determine whether any version earlier than 2.0.0-milestone-10 is in use.
- Plan an upgrade to 2.0.0-milestone-10 or a later release, and verify the version with the vendor, since the record does not list a fixed version.
- Until patched, restrict network access to the Submodel API to trusted clients and place it behind an authenticating gateway where feasible.
- Run the Java process with the least filesystem privileges needed, so that writes are confined to required directories.
Detection guidance
- Review web and application logs for upload requests to the Submodel API that contain unusual or unexpected file name values, such as sequences that navigate directories.
- Monitor for newly created files in directories outside the expected storage path of the service.
- Alert on unexpected child processes or configuration changes originating from the Java service account.
Limitations of the available information
The record has no affected or fixed version entries, no SSVC data and no KEV details. The source status is Awaiting Analysis. The fixed-version boundary is inferred from the wording of the affected range and should be validated against the vendor advisory and the Eclipse tracking issues.
Frequently asked questions
Is CVE-2026-7411 known to be actively exploited?
The CVE is not listed in the CISA KEV catalog in the data consulted, and no confirmed exploitation appears in the sources consulted.
Which versions are affected by CVE-2026-7411?
The record describes versions prior to 2.0.0-milestone-10 of the Eclipse BaSyx Java Server SDK, but the structured affected list is empty and should be confirmed with the vendor.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.