What is the CVSS score of CVE-2026-7411?

CVE-2026-7411 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Eclipse BaSyx Java Server SDK are affected by CVE-2026-7411?

Eclipse BaSyx Java Server SDK versions before 2.0.0-milestone-10 contain a critical remote code execution vulnerability in the Submodel HTTP API that allows unauthenticated attackers to write…. A patch is available.

How to fix or mitigate CVE-2026-7411?

Within 24 hours: Identify all systems running Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10 using asset inventory tools and network scanning; isolate affected systems from production networks if immediate patching is not feasible. Within 7 days: Upgrade all instances to Eclipse BaSyx Java Server SDK version 2.0.0-milestone-10 or later per vendor advisory; validate upgrade in test environment first. Within 30 days: Conduct forensic analysis of affected systems for indicators of compromise; review file system integrity logs and HTTP API access logs for suspicious upload activity; implement network segmentation to restrict Submodel HTTP API access to trusted hosts only.

Eclipse BaSyx Java Server SDK CVE-2026-7411

EUVD-2026-27384 CRITICAL

Path Traversal (CWE-22)

2026-05-05 eclipse

GHSA-8gpm-h2mh-36qc

RCE Java Path Traversal File Upload

10.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

May 05, 2026 - 17:32 EUVD

Analysis Generated

May 05, 2026 - 16:30 vuln.today

DescriptionCVE.org

In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path normalization in the Submodel HTTP API allows an unauthenticated remote attacker to perform a path traversal attack. By supplying a maliciously crafted fileName parameter during a file upload operation, an attacker can bypass intended storage boundaries and write arbitrary files to any location on the host filesystem accessible by the Java process. This can lead to Remote Code Execution (RCE) and complete system compromise.

AnalysisAI

Remote code execution in Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10 allows unauthenticated remote attackers to write arbitrary files anywhere on the host filesystem via path traversal in the Submodel HTTP API's file upload fileName parameter, leading to complete system compromise. The vulnerability receives the maximum CVSS score of 10.0 due to network-accessible exploitation requiring no authentication, privileges, or user interaction, with scope change enabling impact beyond the vulnerable component. EPSS data not available; KEV status not confirmed; exploitation status depends on release recency and deployment exposure of this industrial automation SDK.

Technical ContextAI

Eclipse BaSyx is a Java-based open-source implementation of the Asset Administration Shell (AAS) framework for Industry 4.0 and Industrial IoT applications. The vulnerability resides in the Submodel HTTP API component responsible for handling file upload operations. The root cause is inadequate path normalization (CWE-22: Improper Limitation of a Pathname to a Restricted Directory), where user-supplied fileName parameters are not properly validated or sanitized before being used in filesystem operations. Attackers can inject directory traversal sequences (e.g., '../../../') to escape the intended upload directory. Because the Java process typically runs with application-level permissions, successful exploitation grants filesystem write access to any location writable by that process, including application directories, configuration files, web roots, or system startup locations depending on deployment architecture.

RemediationAI

Upgrade immediately to Eclipse BaSyx Java Server SDK version 2.0.0-milestone-10 or later, which contains fixes for inadequate path normalization in the Submodel HTTP API per vendor advisory at https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/423. Until patching is completed, implement these compensating controls with noted trade-offs: (1) Disable or restrict network access to the Submodel HTTP API file upload endpoints using firewall rules or reverse proxy ACLs limiting access to trusted IP ranges only - reduces exposure but breaks legitimate remote file upload functionality for external clients; (2) Deploy the Java Server SDK in containerized environments with read-only root filesystems and minimal writable volumes, limiting blast radius of arbitrary file writes - adds operational complexity and may require application reconfiguration for legitimate file storage locations; (3) Run the Java process with minimally-privileged dedicated service accounts in isolated filesystem namespaces (chroot/containers) preventing writes to critical system paths - effective mitigation but requires infrastructure changes and testing to ensure application functionality. None of these workarounds fully eliminate the vulnerability; upgrading to the patched version remains the only complete remediation. Organizations unable to upgrade immediately should combine multiple compensating controls and implement enhanced monitoring for unexpected filesystem modifications.