Vulnerability Cve-2026-7411

CVE-2026-7411 - Vulnerability-Lookup

Cancel OK

Success

Action not permitted

Modal body text goes here.

Modal Title

Modal Body

Source (Optional)

Cancel Confirm

CVE-2026-7411

(GCVE-0-2026-7411)

Vulnerability from cvelistv5 – Published: 2026-05-05 14:07 – Updated: 2026-05-06 15:25

About the model.'> VLAI?

About the model.'> EPSS

Summary In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path normalization in the Submodel HTTP API allows an unauthenticated remote attacker to perform a path traversal attack. By supplying a maliciously crafted fileName parameter during a file upload operation, an attacker can bypass intended storage boundaries and write arbitrary files to any location on the host filesystem accessible by the Java process. This can lead to Remote Code Execution (RCE) and complete system compromise.

About CVSS'> Severity ?

10 (Critical)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CWE

CWE-22

- Improper Limitation of a Pathname to a Restricted Directory

Assigner

eclipse

References

2 references

URL Tags

https://gitlab.eclipse.org/security/vulnerability…

https://gitlab.eclipse.org/security/cve-assignmen…

Impacted products

1 product

Vendor Product Version

Eclipse Foundation Eclipse BaSyx

Affected: 0 , (custom)

Create a notification for this product.

Credits

Mohamed Lemine Ahmed Jidou (AegisSec)

Show details on NVD website

JSON

Hacker News

Mastodon

Pinboard

To clipboard

"containers": { "adp": [ "metrics": [ "other": { "content": { "id": "CVE-2026-7411", "options": [ "Exploitation": "poc" }, "Automatable": "yes" }, "Technical Impact": "total" ], "role": "CISA Coordinator", "timestamp": "2026-05-05T17:01:53.279261Z", "version": "2.0.3" }, "type": "ssvc" ], "providerMetadata": { "dateUpdated": "2026-05-06T15:25:50.007Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "references": [ "tags": [ "exploit" ], "url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/423" ], "title": "CISA ADP Vulnrichment" ], "cna": { "affected": [ "defaultStatus": "unaffected", "product": "Eclipse BaSyx", "vendor": "Eclipse Foundation", "versions": [ "lessThan": "2.0.0-milestone-10", "status": "affected", "version": "0", "versionType": "custom" ], "credits": [ "lang": "en", "type": "finder", "value": "Mohamed Lemine Ahmed Jidou (AegisSec)" ], "descriptions": [ "lang": "en", "supportingMedia": [ "base64": false, "type": "text/html", "value": "In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path normalization in the Submodel HTTP API allows an unauthenticated remote attacker to perform a path traversal attack. By supplying a maliciously crafted \u003ccode\u003efileName\u003c/code\u003e parameter during a file upload operation, an attacker can bypass intended storage boundaries and write arbitrary files to any location on the host filesystem accessible by the Java process. This can lead to Remote Code Execution (RCE) and complete system compromise." ], "value": "In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path normalization in the Submodel HTTP API allows an unauthenticated remote attacker to perform a path traversal attack. By supplying a maliciously crafted fileName parameter during a file upload operation, an attacker can bypass intended storage boundaries and write arbitrary files to any location on the host filesystem accessible by the Java process. This can lead to Remote Code Execution (RCE) and complete system compromise." ], "metrics": [ "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" }, "format": "CVSS", "scenarios": [ "lang": "en", "value": "GENERAL" ], "problemTypes": [ "descriptions": [ "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory", "lang": "en", "type": "CWE" ], "providerMetadata": { "dateUpdated": "2026-05-05T14:07:53.476Z", "orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "shortName": "eclipse" }, "references": [ "url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/423" }, "url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/102" ], "source": { "discovery": "UNKNOWN" }, "x_generator": { "engine": "Vulnogram 1.0.2" }, "cveMetadata": { "assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "assignerShortName": "eclipse", "cveId": "CVE-2026-7411", "datePublished": "2026-05-05T14:07:53.476Z", "dateReserved": "2026-04-29T13:21:00.646Z", "dateUpdated": "2026-05-06T15:25:50.007Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.2", "vulnerability-lookup:meta": { "epss":...

Vulnerability Cve-2026-7411

Related Articles

Elevated error rates on requests to multiple models

Donald Trump and sons to be 'forever' exempt from tax audits

PopuLoRA: Co-Evolving LLM Populations for Reasoning Self- Play

Old Reddit Is Down

The ultimate female fantasy – A feminist critique of Beauty and the Beast