Cyber Posture

CVE-2026-7411

Critical

Published: 05 May 2026

Published
05 May 2026
Modified
06 May 2026
KEV Added
—
Patch
—
CVSS Score 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0010 27.4th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path normalization in the Submodel HTTP API allows an unauthenticated remote attacker to perform a path traversal attack. By supplying a maliciously crafted fileName parameter during a file upload…

more

operation, an attacker can bypass intended storage boundaries and write arbitrary files to any location on the host filesystem accessible by the Java process. This can lead to Remote Code Execution (RCE) and complete system compromise.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly addresses inadequate path normalization by requiring validation of the fileName parameter in Submodel HTTP API file uploads to block path traversal sequences.

SI-2 Flaw Remediation good match
prevent

Mandates timely flaw remediation through upgrading Eclipse BaSyx Java Server SDK to version 2.0.0-milestone-10 or later, fixing the path traversal vulnerability.

RA-5 Vulnerability Monitoring and Scanning partial match
detect

Enables vulnerability scanning to identify path traversal flaws like CVE-2026-7411 in the HTTP API prior to exploitation.

Security SummaryAI

CVE-2026-7411 is a critical path traversal vulnerability (CWE-22) affecting Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10. The flaw arises from inadequate path normalization in the Submodel HTTP API, which fails to properly validate the fileName parameter during file upload operations. This allows attackers to bypass intended storage boundaries and write arbitrary files to locations on the host filesystem accessible by the Java process.

An unauthenticated remote attacker can exploit this vulnerability over the network with low complexity and no privileges required. By crafting a malicious fileName parameter in a file upload request, the attacker can achieve remote code execution (RCE) and full system compromise, as indicated by the CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

Eclipse security advisories provide further details on mitigation, available at https://gitlab.eclipse.org/security/cve-assignment/-/issues/102 and https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/423. Upgrading to version 2.0.0-milestone-10 or later addresses the inadequate path normalization issue.

Details

CWE(s)
CWE-22

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1105 Ingress Tool Transfer Command And Control
Adversaries may transfer tools or other files from an external system into a compromised environment.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
Why these techniques?

Path traversal in unauthenticated HTTP file upload API directly enables T1190 (public-facing app exploitation) for RCE; facilitates T1105 (arbitrary file ingress) and T1505.003 (web shell deployment via crafted file writes).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

References