BASIS BBj versions prior to 25.00 have a vulnerability in a Jetty-served web endpoint that improperly validates input path segments, allowing unauthenticated directory traversal. This can lead to reading arbitrary system files accessible by the service account, including configuration files that contain credentials for BBj Enterprise Manager. These credentials can grant administrative access and enable execution of system commands under the service account. The impact depends on the operating system and service account privileges, potentially exposing sensitive system and application data.