CVE-2025-34320 is a critical path traversal vulnerability (CWE-22) in BASIS BBj versions before 25.00. The vulnerability arises because a Jetty-served web endpoint does not properly validate or canonicalize input path segments, allowing unauthenticated attackers to traverse directories and read arbitrary files accessible to the BBj service account. Access to configuration artifacts may reveal credentials for BBj Enterprise Manager, which can be used to gain administrative access and execute system commands with the service account's privileges. The extent of impact depends on the operating system and the privileges assigned to the BBj service account, potentially exposing sensitive system or application data.

An unauthenticated attacker can exploit this vulnerability to read arbitrary files on the server running BASIS BBj, including sensitive configuration files that may contain administrative credentials. With these credentials, the attacker can gain administrative access to BBj Enterprise Manager and execute system commands under the service account. This can lead to unauthorized control over the system and exposure of confidential information. The severity is critical with a CVSS 4.0 score of 9.3, reflecting high exploitability and impact without requiring privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the vulnerable Jetty-served endpoint and monitor for unauthorized access attempts. Avoid exposing the service to untrusted networks. Follow BASIS International Ltd.'s advisories for updates and apply patches promptly once released.