CVE-2026-57898: Eclipse BaSyx Unauthenticated File Write in IIoT SDK (CVSS 9.0)

A critical unauthenticated arbitrary file write vulnerability (CVE-2026-57898, CVSS 9.0) in the Eclipse BaSyx Java Server SDK thumbnail upload API allows attackers to supply a client-controlled fileName (including path traversal) and write arbitrary files to hosts using the MongoDB backend; this can lead to remote code execution, OT network pivoting, data tampering, and supply-chain disruption. The report identifies affected versions (2.0.0-milestone-05 through milestone-12), provides an exploitation scenario and detection indicators, and recommends immediate actions including patching to a fixed release, restricting API access, adding authentication, and scanning for compromise.