In Eclipse BaSyx Java Server SDKs released before 2.0.0-milestone-10, the Submodel HTTP API fails to properly normalize path segments. By sending a specially crafted fileName parameter during a file upload, an unauthenticated attacker can traverse out of the intended storage directory and write an arbitrary file to any location that the Java process can access. This flaw is a classic path‑traversal vulnerability (CWE‑22) that finally allows remote code execution when the attacker places a malicious payload on the host file system.

The affected product is the Eclipse BaSyx Java Server SDK from the Eclipse Foundation. Versions older than 2.0.0‑milestone‑10 are susceptible. No other affected products were listed in the CNA data.

With a CVSS score of 10, the vulnerability is classified as critical. The EPSS score is not available and the issue is not listed in CISA’s KEV catalog, but the remote, unauthenticated attack vector and the ability to overwrite any file give the flaw a very high practical risk. Attackers would need only network access to the Submodel HTTP API and the ability to supply the fileName parameter to exploit the flaw, making it simple to execute arbitrary code on the host system.