CVE-2026-79653: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Eclipse Foundation Eclipse SW360

Eclipse SW360 versions 19.0.0, 19.1.0, 19.2.0, 20.0.0, and 20.1.0 contain a CWE-22 path traversal vulnerability when the system is configured to store attachments on the file system (enable.attachment.store.to.file.system). This allows an attacker with limited privileges to manipulate filenames during upload to cause arbitrary file path traversal. No official patch or fixed version is explicitly stated in the provided data. The immediate workaround is to disable the file system storage configuration.

An attacker with low privileges can exploit this vulnerability to traverse directories on the file system, potentially accessing or overwriting files outside the intended storage directory. This could lead to unauthorized file access or modification. The CVSS 4.0 score is 6.0 (medium severity), reflecting network attack vector, low attack complexity, partial privileges required, no user interaction, and high impact on integrity.

Since no official patch or fixed version is confirmed, the recommended mitigation is to disable the enable.attachment.store.to.file.system configuration to prevent file system storage of attachments. Users should monitor the vendor advisory for updates regarding official fixes or patches.