CVE-2026-57898: Eclipse BaSyx Path Traversal Vulnerability

CVE-2026-57898 Overview

CVE-2026-57898 is an unauthenticated arbitrary file write vulnerability in the Eclipse BaSyx Java Server SDK. It affects deployments using the MongoDB backend across versions 2.0.0-milestone-05 through 2.0.0-milestone-12. The flaw resides in the Asset Administration Shell (AAS) thumbnail API, which accepts a client-controlled fileName parameter without normalization. Remote attackers can write arbitrary files anywhere the Java process has write permission, potentially achieving remote code execution. The issue is classified as a path traversal weakness [CWE-22] and is fixed in 2.0.0-milestone-13.

Critical Impact
Unauthenticated remote attackers can write arbitrary files to the server filesystem, enabling potential remote code execution against Eclipse BaSyx deployments backed by MongoDB.

Affected Products

Eclipse BaSyx Java Server SDK 2.0.0-milestone-05 through 2.0.0-milestone-12 (MongoDB backend)
Deployments exposing the AAS thumbnail upload and retrieval API
Not affected: default InMemory backend, which normalizes and restricts paths

Discovery Timeline

2026-07-14 - CVE-2026-57898 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-57898

Vulnerability Analysis

The vulnerability exists in the AAS thumbnail handling logic of the BaSyx Java Server SDK. The upload endpoint accepts a fileName request parameter supplied by the client. This value is passed through repository file handling as both a repository key and, during retrieval, as a local filesystem path.

When the MongoDB file repository is configured, the filename is treated as an opaque GridFS key. No normalization, sanitization, or path restriction is applied. An attacker can supply a filename containing absolute path components or ../ traversal sequences.

On retrieval, the SDK writes the previously uploaded bytes to the attacker-chosen filesystem path. The attack requires no authentication and can be executed remotely against any exposed BaSyx server using the MongoDB backend.

Root Cause

The root cause is missing input validation on the fileName parameter combined with inconsistent handling between the storage layer and the retrieval layer. The MongoDB backend accepts arbitrary strings as GridFS keys, while the retrieval logic uses the same string as a filesystem destination. This dual interpretation, without path normalization, produces classic path traversal behavior [CWE-22].

Attack Vector

Exploitation occurs over the network against the AAS thumbnail API. An attacker submits a thumbnail upload request with a crafted fileName such as an absolute path or a relative path containing .. segments. The malicious payload is stored under the attacker-controlled key in GridFS. The attacker then triggers thumbnail retrieval, causing the server to write the stored bytes to the attacker-specified filesystem location. Writing to locations such as web application deployment directories, cron directories, or startup script paths can lead to remote code execution.

No verified public exploit code is available. See the Eclipse CVE Assignment Work Item for advisory details.

Detection Methods for CVE-2026-57898

Indicators of Compromise

HTTP requests to AAS thumbnail endpoints containing .., %2e%2e, or absolute path prefixes such as /etc/, /opt/, or C:\ in the fileName parameter
Unexpected files appearing in application directories, web root paths, or system directories owned by the Java process user
New or modified .jsp, .war, .sh, or cron files created by the BaSyx service account
GridFS entries with filename keys containing traversal sequences or absolute paths

Detection Strategies

Inspect BaSyx access logs for POST or PUT requests to AAS thumbnail endpoints with suspicious fileName values
Deploy web application firewall rules to flag path traversal payloads in the thumbnail upload parameter
Monitor filesystem write activity from the BaSyx Java process outside of expected working directories

Monitoring Recommendations

Enable file integrity monitoring on directories writable by the BaSyx service account
Ingest BaSyx application and MongoDB audit logs into a centralized SIEM for correlation
Alert on GridFS document inserts where the filename field contains path separator characters

How to Mitigate CVE-2026-57898

Immediate Actions Required

Upgrade Eclipse BaSyx Java Server SDK to version 2.0.0-milestone-13 or later
Restrict network exposure of the AAS thumbnail API to trusted clients only
Audit filesystem locations writable by the BaSyx Java process for unauthorized files
Rotate credentials and inspect for persistence artifacts if exploitation is suspected

Patch Information

The vendor fix is available in Eclipse BaSyx Java Server SDK 2.0.0-milestone-13. The patch introduces filename normalization and restricts thumbnail storage to a controlled path. Refer to the Eclipse CVE Assignment Work Item for the authoritative advisory.

Workarounds

Switch from the MongoDB backend to the default InMemory backend, which normalizes and restricts file paths
Place a reverse proxy in front of BaSyx that rejects requests containing .., %2e%2e, or absolute path characters in the fileName parameter
Run the BaSyx Java process under a low-privilege user account with write permissions limited to a dedicated data directory

bash

# Example reverse proxy rule (nginx) to block traversal in fileName
if ($arg_fileName ~* "(\.\./|\.\.\\|^/|^[a-zA-Z]:\\)") {
    return 400;
}