CVE-2026-7411: Eclipse BaSyx Path Traversal Vulnerability

CVE-2026-7411 Overview

CVE-2026-7411 is a path traversal vulnerability in the Eclipse BaSyx Java Server SDK affecting versions prior to 2.0.0-milestone-10. The flaw resides in the Submodel HTTP API, which performs inadequate path normalization on the fileName parameter during file upload operations. An unauthenticated remote attacker can supply a crafted fileName value to escape intended storage boundaries and write arbitrary files anywhere the Java process can reach. Successful exploitation enables Remote Code Execution (RCE) and full host compromise. The weakness is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
Unauthenticated remote attackers can write arbitrary files to the host filesystem and achieve Remote Code Execution against Eclipse BaSyx deployments.

Affected Products

Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10
Submodel HTTP API component handling file upload operations
Java applications embedding the vulnerable BaSyx Server SDK

Discovery Timeline

2026-05-05 - CVE-2026-7411 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-7411

Vulnerability Analysis

The Eclipse BaSyx Java Server SDK implements an Asset Administration Shell (AAS) Submodel HTTP API that accepts file uploads from clients. The upload handler trusts the fileName parameter supplied by the requester and uses it to construct a destination path on disk. Because the SDK fails to normalize or canonicalize this input, traversal sequences such as ../ resolve outside the intended storage directory.

An unauthenticated attacker reaches the endpoint over the network and submits a single HTTP request to plant a file. The attacker controls both the destination path and the file contents, enabling overwrite of configuration, web application archives, scheduled task definitions, or SSH key material. Writing to a location loaded by the Java process or operating system converts arbitrary file write into Remote Code Execution.

Root Cause

The root cause is missing path canonicalization before concatenating the user-supplied fileName with the storage base directory. The Submodel HTTP API does not validate that the resolved absolute path remains within the configured upload root, and it does not strip or reject path separators and parent directory references.

Attack Vector

Exploitation requires only network access to the BaSyx Submodel HTTP API and no authentication or user interaction. The attacker issues a file upload request with a fileName containing traversal sequences targeting a writable, security-sensitive location. The Java process writes the attacker-controlled bytes to that path, and code execution follows when the planted file is loaded by the runtime, application server, or scheduled job. Refer to the Eclipse Vulnerability Report for additional context.

Detection Methods for CVE-2026-7411

Indicators of Compromise

HTTP requests to Submodel API file upload endpoints containing ../, ..\, URL-encoded %2e%2e%2f, or absolute paths in the fileName parameter.
Files appearing outside the configured BaSyx storage directory with timestamps matching inbound HTTP traffic.
New or modified files in sensitive locations such as web application WEB-INF/, cron directories, ~/.ssh/authorized_keys, or Java classpath directories owned by the BaSyx process user.
Unexpected child processes spawned by the Java process running the BaSyx Server SDK.

Detection Strategies

Inspect web server and reverse proxy access logs for Submodel upload requests with traversal patterns in query strings or multipart form fields.
Enable file integrity monitoring on directories the BaSyx process can reach to flag writes outside the designated upload root.
Correlate file creation events with subsequent process execution from the same path to identify write-then-execute chains.

Monitoring Recommendations

Forward BaSyx application logs, host process telemetry, and file system audit events to a centralized analytics platform for retention and correlation.
Alert on Java processes writing to non-allowlisted directories or executing binaries from world-writable paths.
Track outbound network connections initiated by the BaSyx Java process to detect post-exploitation command and control activity.

How to Mitigate CVE-2026-7411

Immediate Actions Required

Upgrade the Eclipse BaSyx Java Server SDK to version 2.0.0-milestone-10 or later in all environments.
Restrict network exposure of the Submodel HTTP API to trusted segments using firewall rules or service mesh policies until patching is complete.
Audit the filesystem of BaSyx hosts for unexpected files written outside the configured upload directory since the service was deployed.
Rotate any credentials, keys, or secrets accessible to the BaSyx process account if compromise cannot be ruled out.

Patch Information

The Eclipse BaSyx project addresses the path traversal flaw in version 2.0.0-milestone-10. Tracking and remediation details are documented in the Eclipse CVE Assignment Issue and the Eclipse Vulnerability Report Issue. Rebuild and redeploy any downstream applications that bundle the BaSyx Server SDK as a dependency.

Workarounds

Place the Submodel HTTP API behind a reverse proxy that rejects requests containing .., encoded traversal sequences, or absolute paths in upload parameters.
Run the BaSyx Java process under a dedicated low-privilege account with a restrictive umask and no write access outside the intended upload directory.
Apply mandatory access controls such as SELinux or AppArmor profiles to confine the Java process to a narrow set of writable paths.
Disable file upload functionality in the Submodel API if it is not required by the deployment.

bash

# Example reverse proxy filter (nginx) blocking traversal in fileName
location /submodel/ {
    if ($request_uri ~* "(\.\./|\.\.\\|%2e%2e%2f|%2e%2e/)") {
        return 400;
    }
    proxy_pass http://basyx_backend;
}