In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path normalization in the Submodel HTTP API allows an unauthenticated remote a…

CVE-2026-7411 affects Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10. The vulnerability stems from inadequate path normalization in the Submodel HTTP API, allowing unauthenticated remote attackers to perform path traversal attacks. Attackers can exploit this by supplying maliciously crafted fileName parameters during file upload operations to bypass storage boundaries. This allows arbitrary file writes to any location accessible by the Java process on the host filesystem. The vulnerability can lead to Remote Code Execution (RCE) and complete system compromise. The flaw requires no authentication, making it particularly dangerous for exposed systems.