Eclipse BaSyx Java Server SDK versions before 2.0.0-milestone-10 contain an improper limitation of a pathname to a restricted directory (CWE-22) in the Submodel HTTP API. The vulnerability arises from inadequate path normalization when handling the fileName parameter during file upload operations. An unauthenticated remote attacker can exploit this flaw to perform a path traversal attack, writing files outside the intended storage directories. This can result in remote code execution and complete compromise of the affected system. The CVSS 3.1 base score is 10.0 (critical), reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch available at this time.

Successful exploitation allows unauthenticated remote attackers to write arbitrary files anywhere on the host filesystem accessible by the Java process, potentially leading to remote code execution and complete system compromise. The vulnerability affects confidentiality, integrity, and availability at the highest severity level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the vulnerable service and monitor for suspicious file upload activity. Avoid exposing the affected Eclipse BaSyx Java Server SDK to untrusted networks.