CVE-2026-7411

Critical

Published: 05 May 2026

Published

05 May 2026

Modified

06 May 2026

KEV Added

—

Patch

—

CVSS Score 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS Score 0.0013 32.3th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-7411 is a critical-severity Path Traversal (CWE-22) vulnerability. Its CVSS base score is 10.0 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly addresses inadequate path normalization by requiring validation of the fileName parameter in Submodel HTTP API file uploads to block path traversal sequences.

SI-2 Flaw Remediation good match

prevent

Mandates timely flaw remediation through upgrading Eclipse BaSyx Java Server SDK to version 2.0.0-milestone-10 or later, fixing the path traversal vulnerability.

RA-5 Vulnerability Monitoring and Scanning partial match

detect

Enables vulnerability scanning to identify path traversal flaws like CVE-2026-7411 in the HTTP API prior to exploitation.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1105 Ingress Tool Transfer Command And Control

Adversaries may transfer tools or other files from an external system into a compromised environment.

attack.mitre.org →

T1505.003 Web Shell Persistence

Adversaries may backdoor web servers with web shells to establish persistent access to systems.

attack.mitre.org →

Why these techniques?

Path traversal in unauthenticated HTTP file upload API directly enables T1190 (public-facing app exploitation) for RCE; facilitates T1105 (arbitrary file ingress) and T1505.003 (web shell deployment via crafted file writes).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path normalization in the Submodel HTTP API allows an unauthenticated remote attacker to perform a path traversal attack. By supplying a maliciously crafted fileName parameter during a file upload…

operation, an attacker can bypass intended storage boundaries and write arbitrary files to any location on the host filesystem accessible by the Java process. This can lead to Remote Code Execution (RCE) and complete system compromise.

Deeper analysisAI

CVE-2026-7411 is a critical path traversal vulnerability (CWE-22) affecting Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10. The flaw arises from inadequate path normalization in the Submodel HTTP API, which fails to properly validate the fileName parameter during file upload operations. This allows attackers to bypass intended storage boundaries and write arbitrary files to locations on the host filesystem accessible by the Java process.

An unauthenticated remote attacker can exploit this vulnerability over the network with low complexity and no privileges required. By crafting a malicious fileName parameter in a file upload request, the attacker can achieve remote code execution (RCE) and full system compromise, as indicated by the CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

Eclipse security advisories provide further details on mitigation, available at https://gitlab.eclipse.org/security/cve-assignment/-/issues/102 and https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/423. Upgrading to version 2.0.0-milestone-10 or later addresses the inadequate path normalization issue.