GHSA-8gpm-h2mh-36qc

Source

https://github.com/advisories/GHSA-8gpm-h2mh-36qc

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-8gpm-h2mh-36qc/GHSA-8gpm-h2mh-36qc.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-8gpm-h2mh-36qc

Aliases

CVE-2026-7411

Published

2026-05-05T18:33:26Z

Modified

2026-05-11T16:41:32Z

Severity

10.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS Calculator

Summary

Eclipse BaSyx Java Server SDK vulnerable to Path Traversal

Details

In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path normalization in the Submodel HTTP API allows an unauthenticated remote attacker to perform a path traversal attack. By supplying a maliciously crafted fileName parameter during a file upload operation, an attacker can bypass intended storage boundaries and write arbitrary files to any location on the host filesystem accessible by the Java process. This can lead to Remote Code Execution (RCE) and complete system compromise.

Database specific

{
    "cwe_ids":  [
        "CWE-22"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-05-11T16:22:41Z",
    "nvd_published_at":  "2026-05-05T16:16:18Z",
    "severity":  "CRITICAL"
}

References

Affected packages

Maven / org.eclipse.basyx:basyx.sdk

Package

Name: org.eclipse.basyx:basyx.sdk; View open source insights on deps.dev
Purl: pkg:maven/org.eclipse.basyx/basyx.sdk

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.0.0-milestone-10

Affected versions

1.*

1.0.1

1.0.2

1.1.0

1.2.0

1.3.0

1.3.1

1.4.0

1.5.0

1.5.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-8gpm-h2mh-36qc/GHSA-8gpm-h2mh-36qc.json"