Eclipse BaSyx Java Server SDK versions before 2.0.0-milestone-10 contain a path traversal vulnerability in the Submodel HTTP API. This flaw allows unauthenticated remote attackers to upload files with crafted filenames that bypass storage boundaries, enabling arbitrary file writes on the host filesystem accessible by the Java process. Successful exploitation can lead to remote code execution and full system compromise. A patch is available in version 2.0.0-milestone-10.