10

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-7411

CVE-2026-7411: Eclipse BaSyx Java Server SDK vulnerable to Path Traversal

In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path normalization in the Submodel HTTP API allows an unauthenticated remote attacker to perform a path traversal attack. By supplying a maliciously crafted fileName parameter during a file upload operation, an attacker can bypass intended storage boundaries and write arbitrary files to any location on the host filesystem accessible by the Java process. This can lead to Remote Code Execution (RCE) and complete system compromise.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-7411

CVE-2026-7411:

10

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.eclipse.basyx:basyx.sdk	maven	< 2.0.0-milestone-10	2.0.0-milestone-10

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic path traversal issue within the file upload functionality of the Eclipse BaSyx Java Server SDK. An unauthenticated attacker could craft a malicious 'fileName' parameter in a file upload request to write a file to an arbitrary location on the host filesystem. The root cause was twofold: first, at a high level in 'SubmodelFileOperations.setFileValue', the 'fileName' was not validated for traversal sequences. Second, at a lower level in 'InMemoryFileRepository.save', the file path was constructed by unsafely concatenating a directory path and the user-provided filename. The patch addresses both issues by adding explicit validation and safe path handling logic, throwing a 'SecurityException' upon detecting a traversal attempt. During exploitation, a profiler would show calls to these vulnerable functions, originating from the Submodel HTTP API endpoint that handles file uploads.

Vulnerable functions

org.eclipse.digitaltwin.basyx.submodelservice.backend.SubmodelFileOperations.setFileValue

basyx.submodelservice/basyx.submodelservice-backend/src/main/java/org/eclipse/digitaltwin/basyx/submodelservice/backend/SubmodelFileOperations.java

This function is responsible for setting the file value for a submodel element. It takes a 'fileName' as input, which is user-controllable. Before the patch, this 'fileName' was used to construct a unique file name without proper sanitization, allowing for path traversal attacks. The patch introduces the 'validateLogicalFileName' method to sanitize the 'fileName' and prevent traversal.

org.eclipse.digitaltwin.basyx.core.filerepository.InMemoryFileRepository.save

basyx.common/basyx.filerepository-backend-inmemory/src/main/java/org/eclipse/digitaltwin/basyx/core/filerepository/InMemoryFileRepository.java

This function saves a file to the in-memory file repository. It constructs the file path using the 'fileName' from the 'FileMetadata'. The original implementation in the private 'createFilePath' method was vulnerable to path traversal as it directly concatenated the temporary directory with the provided file name. The patch fixes this by normalizing the path and checking if it remains within the intended base directory.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.