In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path normalization in the Submodel HTTP API allows an unauthenticated remote a…

CVE-2026-7411 affects Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10. The vulnerability involves inadequate path normalization in the Submodel HTTP API that allows unauthenticated remote attackers to perform path traversal attacks. Attackers can exploit a maliciously crafted fileName parameter during file upload operations to bypass storage boundaries. This enables writing arbitrary files to any location accessible by the Java process on the host filesystem. The vulnerability can lead to Remote Code Execution (RCE) and complete system compromise. The flaw represents a critical security issue due to its unauthenticated remote exploitation capability.