org.eclipse.basyx vulnerabilities

Products

• org.eclipse.basyx/basyx.sdk 2

Latest org.eclipse.basyx CVEs

Newest publication first

1. CVE-2026-7412 Eclipse BaSyx Java Server SDK vulnerable to Server-Side Request Forgery

   Published 2026-05-05

   High·CVSS 8.6 EPSS 0.52%

   In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, the Operation Delegation feature fails to validate the destination URI of delegated requests. An unauthenticated remote attacker can exploit this design flaw to force the BaSyx server to execute blind HTTP POS...

2. CVE-2026-7411 Eclipse BaSyx Java Server SDK vulnerable to Path Traversal

   Published 2026-05-05

   Critical·CVSS 10.0 EPSS 3.7%

   In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path normalization in the Submodel HTTP API allows an unauthenticated remote attacker to perform a path traversal attack. By supplying a maliciously crafted fileName parameter during a file upload o...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.