The vulnerability enables an unauthenticated attacker to perform arbitrary file writes on a server running the Eclipse BaSyx Java Server SDK with a MongoDB backend. By supplying a specially crafted fileName parameter to the AAS thumbnail upload API, the attacker can cause payload bytes to be stored at any filesystem location writable by the Java process. This flaw combines a filesystem path abuse (CWE‑22) with insecure handling of client‑controlled names (CWE‑73), potentially allowing the attacker to write executable code to a web‑accessible directory and achieve remote code execution.

Affected systems include deployments of Eclipse BaSyx Java Server SDK versions 2.0.0‑milestone‑05 through 2.0.0‑milestone‑12 that use a MongoDB data store. The default InMemory backend is not affected because it sanitizes the path. The issue is fixed in milestone‑13.

The CVSS score is 9.0, indicating a high‑severity flaw, while the EPSS score is less than 1%, suggesting the exploitation probability is currently low. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires no authentication and leverages the thumbnail upload API, making it readily accessible to anyone who can reach the service. Attackers can remotely trigger the file write simply by sending an HTTP request with an absolute or traversal‑style filename and then initiating a thumbnail retrieval to write the file to the chosen path; if the server allows execution of files in the written directory, remote code execution becomes feasible.