Eclipse BaSyx Java Server SDK versions before 2.0.0-milestone-10 contain an improper limitation of a pathname to a restricted directory (CWE-22) in the Submodel HTTP API. The vulnerability arises from inadequate path normalization when handling the fileName parameter during file upload operations. An unauthenticated remote attacker can exploit this flaw to perform a path traversal attack, writing arbitrary files anywhere on the host filesystem accessible by the Java process. This can result in remote code execution and complete system compromise. The CVSS 3.1 base score is 10.0, reflecting the critical nature of this vulnerability. No patch or official remediation level has been published by the vendor as of the data provided.

Successful exploitation allows unauthenticated remote attackers to write arbitrary files to any location on the host filesystem accessible by the Java process, potentially leading to remote code execution and full system compromise. The vulnerability affects confidentiality, integrity, and availability with a CVSS score of 10. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the vulnerable service and monitor for suspicious file upload activity. Avoid exposing the affected versions to untrusted networks. Follow vendor channels for updates on patches or mitigations.