Eclipse BaSyx CVE-2026-57898

Exploitation requires the BaSyx server to be deployed with the MongoDB (GridFS) file repository backend - the default InMemory backend is not affected because it normalizes and restricts paths to its temporary directory. The attacker must reach the AAS thumbnail API over the network and perform two steps: upload thumbnail content with an absolute or traversal-style fileName, then trigger thumbnail retrieval so the bytes are flushed to the chosen filesystem path. No authentication or user interaction is needed (PR:N, UI:N), but exploitation is limited by the non-default backend requirement, the two-step upload-then-retrieve sequence (reflected as AC:H), and the file permissions of the Java process - writes only succeed where that process can write, and escalation to RCE depends on a writable, code-executing target path being available.

The CVSS 3.1 score of 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) reflects a network-reachable, unauthenticated flaw with scope change and high impact across confidentiality, integrity, and availability, tempered by AC:H. The high attack complexity is consistent with the description: exploitation only works on deployments configured with the MongoDB backend and requires a two-step upload-then-retrieve sequence, so this is not a spray-and-pray bug against every install. No EPSS score, KEV listing, or POC was provided, so real-world exploitation pressure is presently unquantified - treat the score as a capability ceiling rather than evidence of active targeting. The PR:N rating is vendor-supplied and matches the 'unauthenticated' language in the description. Net assessment: a genuine high-priority issue for any organization actually running BaSyx on the MongoDB backend, but the non-default backend requirement meaningfully narrows the exposed population; low prevalence of the product overall keeps aggregate risk contained.

An attacker who can reach a BaSyx server running the MongoDB backend uploads thumbnail content while supplying a traversal or absolute-path fileName such as one pointing at a web-exec directory or a startup/cron location. They then invoke thumbnail retrieval, causing the server to write the attacker-controlled bytes to that path, which can be leveraged for remote code execution. No public exploit code was identified at time of analysis, and the AC:H rating reflects the required MongoDB configuration plus the multi-step trigger.