{"id":"CVE-2026-57898","details":"In Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 to 2.0.0-milestone-12, deployments using the MongoDB backend are vulnerable to an unauthenticated arbitrary file write through the AAS thumbnail API.\n\n\n\n\nThe AAS thumbnail upload path accepted a client-controlled fileName request parameter and passed it through repository file handling as both a repository key and, during thumbnail retrieval, a local filesystem path. With the MongoDB file repository, the supplied filename was treated as an opaque GridFS key and was not normalized or restricted as a filesystem path. A remote attacker could upload thumbnail content using an absolute or traversal-style filename, then trigger thumbnail retrieval so that the uploaded bytes were written to the attacker-chosen path on the server filesystem.\n\n\n\n\nThis could allow writing files anywhere the Java process has permission to write and may lead to remote code execution. The default InMemory backend is not affected by this specific path because it normalizes and restricts file paths to its temporary directory.\n\n\n\n\nThe issue is fixed in Eclipse BaSyx Java Server SDK 2.0.0-milestone-13.","modified":"2026-09-01T08:20:10.332808Z","published":"2026-07-14T07:51:19.002Z","database_specific":{"cna_assigner":"eclipse","cwe_ids":["CWE-22","CWE-73"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57898.json"},"references":[{"type":"WEB","url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/159"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57898.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57898"},{"type":"PACKAGE","url":"https://github.com/eclipse-basyx/basyx-java-server-sdk"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/eclipse-basyx/basyx-java-server-sdk","events":[{"introduced":"11dfd22773a2267d1799d220a2fa98a1e215bde9"},{"fixed":"fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3"}],"database_specific":{"extracted_events":[{"introduced":"2.0.0-milestone-05"},{"fixed":"2.0.0-milestone-13"}],"source":"AFFECTED_FIELD"}}],"versions":["2.0.0-milestone-12","2.0.0-milestone-11","2.0.0-milestone-10","2.0.0-milestone-09.1","2.0.0-milestone-09","2.0.0-milestone-08","2.0.0-milestone-07","2.0.0-milestone-06","2.0.0-milestone-05"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57898.json","vanir_signatures_modified":"2026-09-01T08:20:10Z","vanir_signatures":[{"id":"CVE-2026-57898-027dde7b","signature_type":"Line","signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.submodelservice/basyx.submodelservice-feature-authorization/src/main/java/org/eclipse/digitaltwin/basyx/submodelservice/feature/authorization/AuthorizedSubmodelService.java"},"deprecated":false,"digest":{"line_hashes":["131970998582911293156872341560886624113","152080527172086842303764795221027192817","179172633520368830109001370037703999977"],"threshold":0.9}},{"target":{"file":"basyx.submodelservice/basyx.submodelservice-core/src/main/java/org/eclipse/digitaltwin/basyx/submodelservice/SubmodelService.java"},"deprecated":false,"digest":{"line_hashes":["52573248652692522601474256893827641489","284798331529898454844744399073285805530","322714569534529878009459973687113700079","214807683334260360545780522508005944678","224833080532483642443495294100206658159","295000908629135138212167272817892153859","302566825785828738205599888422335617289","207663388330600727731490561332498280469","63801225721757946140003825091473303140","6133709176243379947315489654646550389","106451722542263547693552143745403329169"],"threshold":0.9},"id":"CVE-2026-57898-0cb0808f","signature_type":"Line","signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3"},{"signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.aasservice/basyx.aasservice-backend/src/main/java/org/eclipse/digitaltwin/basyx/aasservice/backend/AasThumbnailOperations.java","function":"deleteThumbnail"},"deprecated":false,"digest":{"function_hash":"130017021591851889793563857871113306442","length":221},"id":"CVE-2026-57898-0d87f1bc","signature_type":"Function"},{"source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.aasenvironment/basyx.aasenvironment-core/src/main/java/org/eclipse/digitaltwin/basyx/aasenvironment/base/DefaultAASEnvironment.java","function":"getFileContent"},"deprecated":false,"digest":{"function_hash":"272453575271793562857062714428067249450","length":154},"id":"CVE-2026-57898-155fdc8e","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.aasrepository/basyx.aasrepository-feature-discovery-integration/src/main/java/org/eclipse/digitaltwin/basyx/aasrepository/feature/discoveryintegration/DiscoveryIntegrationAasRepository.java"},"deprecated":false,"digest":{"line_hashes":["326298196779425334600991701347697195337","306831961641418344774174584433453801669","127722142903294133951776678587313497945"],"threshold":0.9},"id":"CVE-2026-57898-16278b5b","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-57898-19cb0ddb","signature_type":"Line","signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.submodelservice/basyx.submodelservice-http/src/main/java/org/eclipse/digitaltwin/basyx/submodelservice/http/SubmodelServiceHTTPApiController.java"},"deprecated":false,"digest":{"line_hashes":["203931042970099628200073295325552118954","304471911670795109572534134397055513555","251950231054054430645263458668923082313","43504504582770527208217083742199640487","57981731920283194344692548373240705373","66661138706731387075520776170476475601","126406737121053458146504795709969556385","30789810033032444848357137336728717176","22624999372912449565708663381444203915"],"threshold":0.9}},{"target":{"file":"basyx.submodelservice/basyx.submodelservice-backend/src/main/java/org/eclipse/digitaltwin/basyx/submodelservice/backend/SubmodelFileOperations.java","function":"getFileExtension"},"deprecated":false,"digest":{"function_hash":"52148726377502420196591443205055754474","length":170},"id":"CVE-2026-57898-1cde1169","signature_type":"Function","signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.submodelservice/basyx.submodelservice-backend/src/main/java/org/eclipse/digitaltwin/basyx/submodelservice/backend/SubmodelFileOperations.java"},"deprecated":false,"digest":{"line_hashes":["75199264671315146731313330214030763703","37669725065981372541361920149060037669","141971105334218079866114386344369783394","224584093112730758632928403185742959923","277411176191367764146807242501378165665","328020135006219680579267725162642728584","339415485211030189975997728124975640949","284798331529898454844744399073285805530","48321847133762248733695757091898718517","292377327265557625274228378496609273090","116630868739514558306302218648398945320","74963674646263103725305909511066591987","83447128137747772627933622648407594502","230808226738622944069837839096975443981","162637519801634340771963766497600683904","15565530435956545598876560468524634112","31530264713868678910095980019624717699","70256544454551295023566469544573611015","12256826778782402374342860683729446200","324569734209048696327180257686423669617","192693653600012507726387465731867172031","65930112317191626675226000003391781010","122028112076950721192088223007325392276","248284465711228824787129620364231581336","149451076515587749781060603095299418711","269645594368523434347749371172436731391","139773106838413787287278844304524332252","9480443224563647484283384315850728501","118809889879769910661635343246686678891","48246808242840443798018892871214176943","76312585319453890579099192054273421440","127777697325038663506825718573558361531","193070538991669093369648090635338164158","68035283248898713316548781747650553931","255660045373008425540700290948288142769","1403607766250848125266528317637976053","214941617388442630712023439799926365203","288433650786758387126505113997432240580","238961810262012192405876760898607110811","96197070143078600958601184959631949834","11248925241974289194883671998323005814","166290892236390023509866459642057797442","85876645969484035092462052246837005162","191390131813474266529182959779056145673","161445335095612994558191599512157977195","32870849924186132116527693399340641112","194270040000449291940215216668288553885","210907330831608151482735783603737296552","206506152454392747941314280452166878499","106537632013298111345372505203557661773","60877594425683928895833598071592062134","46195753971984914513426453515241087601","36525329197397102421216290214172475119","150590204608046921131111203398778361611","213702987419031538357973177427002082775","293948058475079613682740672330797754379","27582756804838474798784263756418198246","75996435835860353202508046931889626825","157900280358389218860693518876925484918","210263903454170757452592719783567564564","262609572701329255299298630322947846327","21181356533631695472595451059858160366","235649557191201911889281951061217069275","314245511327916429478733350537889610687","17359103593411058114424993924847014358","197196047757763757417517448053005791485","94290158640858320878033663169652556529","140694042276805586712450238503035148972","170199892697536407148344792928381680705","148614636607036167900885764021368134016","13922009440184528783025194136387236309","51660971320646676126155660492131600645","3069622883924787227978224535716158827","120897553846459322106470476466940504932","86526834340900751742116535360798406897","268910804162251974013037824620162753449","99749650171237720138718696741816019856","93446828567919104404443814726362662725","251744661795694253284573484378302387287","257963409794668407392265673479914330256","263558400933809629109444198618361235498","229708623349022802323660534648341112802","320134049136114064517051971315763262178","17475811027065268166906794548743918606","329082477022808572231233837526378637236","216096143480456564147864833934507031134","86411028524734333658495465391905028403","144687995111924469745204920704304665492","18772149300502566384308226182165582712","285397360013833768386776948427049366275","72654012003509931961364784277341897567","193528758334205364253615432852237676390","274917457460706042913075026270320431865","153373270057395750285668887814334682682","5193959410665385742722796295257111115","82429277905458197127012711449910701249","200190100722633253134749944003490581683","335679159315136055935181465052714264888"],"threshold":0.9},"id":"CVE-2026-57898-1ee2b78b"},{"deprecated":false,"digest":{"line_hashes":["221346474878007103554715325257390753844","136652595977995037365088547715078669383","103753006122969621230326509743754444800"],"threshold":0.9},"id":"CVE-2026-57898-22567686","signature_type":"Line","signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.aasrepository/basyx.aasrepository-client/src/main/java/org/eclipse/digitaltwin/basyx/aasrepository/client/ConnectedAasRepository.java"}},{"deprecated":false,"digest":{"function_hash":"258965366399262350393044910404487521095","length":342},"id":"CVE-2026-57898-249ae707","signature_type":"Function","signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"function":"getFile","file":"basyx.submodelservice/basyx.submodelservice-backend/src/main/java/org/eclipse/digitaltwin/basyx/submodelservice/backend/SubmodelFileOperations.java"}},{"target":{"file":"basyx.submodelservice/basyx.submodelservice-backend/src/main/java/org/eclipse/digitaltwin/basyx/submodelservice/backend/SubmodelFileOperations.java","function":"deleteFileValue"},"deprecated":false,"digest":{"length":411,"function_hash":"282842848530216524291319674077994759144"},"id":"CVE-2026-57898-26963925","signature_type":"Function","signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3"},{"id":"CVE-2026-57898-2afe5532","signature_type":"Function","signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.submodelservice/basyx.submodelservice-backend/src/main/java/org/eclipse/digitaltwin/basyx/submodelservice/backend/SubmodelFileOperations.java","function":"validateLogicalFileName"},"deprecated":false,"digest":{"function_hash":"96005401442781453049562196817840364257","length":375}},{"id":"CVE-2026-57898-2e8ef603","signature_type":"Function","signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.common/basyx.filerepository-backend/src/main/java/org/eclipse/digitaltwin/basyx/core/filerepository/FileRepositoryHelper.java","function":"fetchAndStoreFileLocally"},"deprecated":false,"digest":{"function_hash":"93307160257814845740077877638845116656","length":304}},{"digest":{"line_hashes":["326298196779425334600991701347697195337","306831961641418344774174584433453801669","127722142903294133951776678587313497945"],"threshold":0.9},"id":"CVE-2026-57898-3071cdf5","signature_type":"Line","signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.aasrepository/basyx.aasrepository-feature-registry-integration/src/main/java/org/eclipse/digitaltwin/basyx/aasrepository/feature/registry/integration/RegistryIntegrationAasRepository.java"},"deprecated":false},{"digest":{"function_hash":"169078839678848066549499688190452186605","length":356},"id":"CVE-2026-57898-3157a82e","signature_type":"Function","signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"function":"createAASXPackage","file":"basyx.aasxfileserver/basyx.aasxfileserver-backend/src/main/java/org/eclipse/digitaltwin/basyx/aasxfileserver/backend/CrudAASXFileServer.java"},"deprecated":false},{"id":"CVE-2026-57898-3937cd28","signature_type":"Function","signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.submodelservice/basyx.submodelservice-backend/src/main/java/org/eclipse/digitaltwin/basyx/submodelservice/backend/CrudSubmodelService.java","function":"hasFilePathChanged"},"deprecated":false,"digest":{"function_hash":"82869835615537544610466282969149191058","length":398}},{"id":"CVE-2026-57898-3b2675a7","signature_type":"Function","signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.submodelservice/basyx.submodelservice-http/src/main/java/org/eclipse/digitaltwin/basyx/submodelservice/http/SubmodelServiceHTTPApiController.java","function":"getFileByPath"},"deprecated":false,"digest":{"function_hash":"72531607148109197592266576977120450399","length":269}},{"digest":{"line_hashes":["97328777217233334104391635601759239923","165035091532818462471065746998886691166","338045586794414702682852142501354769964"],"threshold":0.9},"id":"CVE-2026-57898-3e2e41c3","signature_type":"Line","signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.submodelrepository/basyx.submodelrepository-feature-search/src/main/java/org/eclipse/digitaltwin/basyx/submodelrepository/feature/search/SearchSubmodelRepository.java"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["117433402326800974154265257785009585759","97884479263220489366504267417587610172","37669725065981372541361920149060037669","307860591509111565642036396439098638976","82774587340857474983171240934996671246","175039492159702575724129508896967731201","156908101053348301834731973210798102304","331539908857023950414620987836477100555","10132183953476187578173049786932384811","118685350301862885511895860863692489142","213473569412692561013313779141203782770","259170726816696210769209882406149223648","170059409358852097236216565570391115188","272666209870134541357539233465248251772","339869266025769851690019012011974641519","157831751179908349761229783729445811064","268235282622566608616064262719957172701","275065956234684593769426525901867802951","11900365659519212821487394319317104642","73897808625433572174733143841425649447","315232945767176451186044793995485216238","248298645438944084130713706076953007181","82124408742324847447915374584416061753","211511661732473956052556904325061815032","70920799215736493277193071019709255238","156944427432936025694815727601794280266","152253169702179962185212099510222330712","38752073475306285089127900127431015366","74616983399482650001155240067587847831","201156549896027827803976226882527802376","7955648486089809214105329545258484019","223204641159836975621440497085225792013","135036381273404016068313016834046797005","322752613559491677074900225679974170618"],"threshold":0.9},"id":"CVE-2026-57898-43c174ee","signature_type":"Line","signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.common/basyx.filerepository-backend/src/main/java/org/eclipse/digitaltwin/basyx/core/filerepository/FileRepositoryHelper.java"}},{"deprecated":false,"digest":{"function_hash":"292833946524609962506932970307651392836","length":352},"id":"CVE-2026-57898-442fbfd0","signature_type":"Function","signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.submodelservice/basyx.submodelservice-backend/src/main/java/org/eclipse/digitaltwin/basyx/submodelservice/backend/CrudSubmodelService.java","function":"pathsDiffer"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.submodelservice/basyx.submodelservice-feature-kafka/src/main/java/org/eclipse/digitaltwin/basyx/submodelservice/feature/kafka/KafkaSubmodelService.java"},"deprecated":false,"digest":{"line_hashes":["306247293293374558306390256966103909396","237341544095471219567752264717013574036","193296726153282130716410238617902839285"],"threshold":0.9},"id":"CVE-2026-57898-48ac377b"},{"deprecated":false,"digest":{"line_hashes":["167714780572641458300671037755051029424","31689738821410122854957468287129118632","219343990253444605981356060460658984869"],"threshold":0.9},"id":"CVE-2026-57898-48d922aa","signature_type":"Line","signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.submodelservice/basyx.submodelservice-feature-mqtt/src/main/java/org/eclipse/digitaltwin/basyx/submodelservice/feature/mqtt/MqttSubmodelService.java"}},{"target":{"file":"basyx.submodelservice/basyx.submodelservice-backend/src/main/java/org/eclipse/digitaltwin/basyx/submodelservice/backend/CrudSubmodelService.java","function":"updateSubmodelElement"},"deprecated":false,"digest":{"function_hash":"1040773657174734141996355459653036222","length":369},"id":"CVE-2026-57898-4903cc38","signature_type":"Function","signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3"},{"source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.aasrepository/basyx.aasrepository-http/src/main/java/org/eclipse/digitaltwin/basyx/aasrepository/http/AasRepositoryApiHTTPController.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["47673220826181956604880717926749304664","312531929338319708648955966272369989430","337103126048757050562105711909064861109","154826662943544679603205507935459831914","240394941081115115218376853773192427689","168184441756655671644793935224930956150","251950231054054430645263458668923082313","43504504582770527208217083742199640487","150221883166382090491531005822620725239","285383138641597671962231057762052734585","303526079802977503571665730802804328973","317931999491213163832640310349427336125","4817378933103391172773877494417015047","37954116854482131421950172403211006364","114754333857911324012093766182162187542","52015616171230136483075193189580811007","283773849582922133789992110304330294975"]},"id":"CVE-2026-57898-49989d63","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-57898-4c7cf828","signature_type":"Line","signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.submodelservice/basyx.submodelservice-client/src/main/java/org/eclipse/digitaltwin/basyx/submodelservice/client/ConnectedSubmodelService.java"},"deprecated":false,"digest":{"line_hashes":["66472944888192538018937365766753961948","205018546229302127608567493467843079141","254542802293510325660456685039925178025","178689790292439936147562157435152136047","43324067207535793513577056084301594715","121487757362842377608924366262944263592","139301080758932327446835867378340557442","283722957553541131677859006166019980351","215877239605911382076136487407553486068"],"threshold":0.9}},{"signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.submodelservice/basyx.submodelservice-backend/src/main/java/org/eclipse/digitaltwin/basyx/submodelservice/backend/CrudSubmodelService.java","function":"handleFileAttachmentUpdate"},"deprecated":false,"digest":{"function_hash":"228616634487760664283197741655393192242","length":310},"id":"CVE-2026-57898-53ece51e","signature_type":"Function"},{"digest":{"length":112,"function_hash":"25655595438975836319591788211307983558"},"id":"CVE-2026-57898-5aad03d7","signature_type":"Function","signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.submodelservice/basyx.submodelservice-backend/src/main/java/org/eclipse/digitaltwin/basyx/submodelservice/backend/SubmodelFileOperations.java","function":"getInputStream"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["97328777217233334104391635601759239923","165035091532818462471065746998886691166","338045586794414702682852142501354769964"],"threshold":0.9},"id":"CVE-2026-57898-62d89903","signature_type":"Line","signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.submodelrepository/basyx.submodelrepository-feature-registry-integration/src/main/java/org/eclipse/digitaltwin/basyx/submodelrepository/feature/registry/integration/RegistryIntegrationSubmodelRepository.java"}},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["96936089106414743657845615935408593543","105957931602807101961446393285490850060","284411402336925100005014357675790376657","246871152963866046990668897913374683320","86654645402883871874699165632154687153","133104790011740051972267462552694037815","287259312666548818366245598805164565773","331167623392659980435746468957371860339","179433429437391400451381414488578462653","123574920664351202780009497555915193825","40631936594472009727213452182515713774","198802698603431737468102923743870986241"]},"id":"CVE-2026-57898-66a865f6","signature_type":"Line","signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.submodelrepository/basyx.submodelrepository-core/src/main/java/org/eclipse/digitaltwin/basyx/submodelrepository/SubmodelRepository.java"}},{"digest":{"function_hash":"292380374235057067659184621211145723245","length":305},"id":"CVE-2026-57898-683c7a79","signature_type":"Function","signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.submodelservice/basyx.submodelservice-backend/src/main/java/org/eclipse/digitaltwin/basyx/submodelservice/backend/SubmodelFileOperations.java","function":"createFile"},"deprecated":false},{"source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.common/basyx.filerepository-backend/src/main/java/org/eclipse/digitaltwin/basyx/core/filerepository/FileRepositoryHelper.java","function":"saveOrOverwriteFile"},"deprecated":false,"digest":{"function_hash":"324588753831535674371315074501565091022","length":227},"id":"CVE-2026-57898-69f949d7","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.submodelrepository/basyx.submodelrepository-backend/src/main/java/org/eclipse/digitaltwin/basyx/submodelrepository/backend/CrudSubmodelRepository.java"},"deprecated":false,"digest":{"line_hashes":["232854972838183112162313909925157372167","77256252170904391221507683260544055003","298320523888611580270494180324185554043"],"threshold":0.9},"id":"CVE-2026-57898-6a058223","signature_type":"Line"},{"digest":{"function_hash":"15021037060799180288558392694478343849","length":266},"id":"CVE-2026-57898-6c18c7fb","signature_type":"Function","signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.aasservice/basyx.aasservice-backend/src/main/java/org/eclipse/digitaltwin/basyx/aasservice/backend/AasThumbnailOperations.java","function":"setThumbnail"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.aasservice/basyx.aasservice-backend/src/main/java/org/eclipse/digitaltwin/basyx/aasservice/backend/AasThumbnailOperations.java","function":"getThumbnailResourcePathOrThrow"},"deprecated":false,"digest":{"function_hash":"68439096628061648106550029737653038847","length":180},"id":"CVE-2026-57898-6d123d40"},{"id":"CVE-2026-57898-6e626170","signature_type":"Line","signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.aasservice/basyx.aasservice-core/src/main/java/org/eclipse/digitaltwin/basyx/aasservice/AasService.java"},"deprecated":false,"digest":{"line_hashes":["130782734415525451013326290029829951515","1949268495340168620712487563275703638","186526658135118615427181992249818853420","31302119772354133517550991248411664677","129048733695449241116521289261651146374","70896749810412141383505506804210342041","204970066167373824206326315677279420011","216046616808805778598690297723295905168","114530664879788318235132670680322610842","38326192492876597252322259609089851216","70268272365663925723948964271352580011","24738950489992619554098452680032707889","287639480005970551731141323528785461910","262576346312962476856797922941881098105","275418757446287485186443760810530851778","186365751010785352879971985941085939411","143252487184067792832028844862577823509"],"threshold":0.9}},{"source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.submodelrepository/basyx.submodelrepository-client/src/main/java/org/eclipse/digitaltwin/basyx/submodelrepository/client/ConnectedSubmodelRepository.java"},"deprecated":false,"digest":{"line_hashes":["156658233718519444308558003103216221733","129660491227778237757734139619376040852","259266539595486407359535888485402920688"],"threshold":0.9},"id":"CVE-2026-57898-6ffb68b0","signature_type":"Line","signature_version":"v1"},{"target":{"file":"basyx.aasxfileserver/basyx.aasxfileserver-backend/src/main/java/org/eclipse/digitaltwin/basyx/aasxfileserver/backend/CrudAASXFileServer.java","function":"updateAASXByPackageId"},"deprecated":false,"digest":{"function_hash":"270997297462212030563520033142269106617","length":389},"id":"CVE-2026-57898-761b527b","signature_type":"Function","signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3"},{"deprecated":false,"digest":{"line_hashes":["223571791475992659774178865248436648072","67852859961112377905425333858765381235","327640829268601350974225780313637494108","11786452163856678441806980967267544294","281854524749748114135979756592804738206","92556763421270965107659857583527307079","14530437114787730270717959224790063946","30551171543968249703903230763860908043","32246911519682334300616152195265414590","282248879235286442078638826752308148366","136488242043498848918400944754349746016","271971795130162941362238293824106621445","153380227485410307420044489209533553674","96888788090664049626813301013988227071","114091378641568793940974148825692586325","83316000309606799281722420556880908328","171160439136124900400048498392554941954"],"threshold":0.9},"id":"CVE-2026-57898-7767713e","signature_type":"Line","signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.aasservice/basyx.aasservice-backend/src/main/java/org/eclipse/digitaltwin/basyx/aasservice/backend/AasThumbnailOperations.java"}},{"id":"CVE-2026-57898-77a32edd","signature_type":"Line","signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.aasrepository/basyx.aasrepository-core/src/main/java/org/eclipse/digitaltwin/basyx/aasrepository/AasRepository.java"},"deprecated":false,"digest":{"line_hashes":["292192187800003797841780360838247956630","1949268495340168620712487563275703638","310557355851467699529747013607144253040","317520048385863243453832563937796499599","207543753586514806344919469620693960623","268247679137541596911041261030451250443","54951430147347397653701322501603406816","115708323437698899022357394244319375728","50802823954909631934725704372619026428","91857728430268518247379688697938787418","307413859745409359134534126887310514285","242744405158960253090788131039160598709","337200061573514378867125255485880068863","296620860677489575627306762362400632719","161199805494994170335506908043121360938","54652357519510143720135589052486056804","301934652844719952927540685986854845470","21556020491474803171594954087782423183","133056848218028181871917437459130006043","184488499012640784090598999247971169004","266244051286299954115200043875173237353","200215042517507914913003530210256745562","271799589110024786739132790441776629532","7938703302262966885898584537110255512"],"threshold":0.9}},{"target":{"file":"basyx.aasrepository/basyx.aasrepository-http/src/main/java/org/eclipse/digitaltwin/basyx/aasrepository/http/AasRepositoryApiHTTPController.java","function":"getThumbnailAasRepository"},"deprecated":false,"digest":{"function_hash":"140976090731312282595426592834190859412","length":327},"id":"CVE-2026-57898-797e44f4","signature_type":"Function","signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3"},{"deprecated":false,"digest":{"line_hashes":["311721951585559172071845593054043148179","1949268495340168620712487563275703638","186526658135118615427181992249818853420","174201378403780545625829350238370688087","322714569534529878009459973687113700079","214807683334260360545780522508005944678","212174608283505921399384416976380531241","3019365065341142995138718068078181850","309680182262807002703921320662932456119","156062006039482484113211086749613927416","278574152515466373010890927274797278953"],"threshold":0.9},"id":"CVE-2026-57898-7bbc9990","signature_type":"Line","signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.aasservice/basyx.aasservice-client/src/main/java/org/eclipse/digitaltwin/basyx/aasservice/client/ConnectedAasService.java"}},{"deprecated":false,"digest":{"function_hash":"246898154777233700039698584610220329015","length":230},"id":"CVE-2026-57898-876d7265","signature_type":"Function","signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.submodelservice/basyx.submodelservice-backend/src/main/java/org/eclipse/digitaltwin/basyx/submodelservice/backend/SubmodelFileOperations.java","function":"getFileInputStream"}},{"target":{"file":"basyx.aasxfileserver/basyx.aasxfileserver-core/src/test/java/org/eclipse/digitaltwin/basyx/aasxfileserver/core/AASXFileServerSuite.java"},"deprecated":false,"digest":{"line_hashes":["172761887477053565128976275470089563772","162423650790053927697299658620362139927","222164390065745043175249883949579094387","315757955021198300405493881909937603460","36736682947686395329647411227271781102","158462593176568100686022502559105343340","193537719192662749197582057439033327853","10044855036513698107700154768584397969"],"threshold":0.9},"id":"CVE-2026-57898-88447d70","signature_type":"Line","signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3"},{"signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.submodelrepository/basyx.submodelrepository-feature-mqtt/src/main/java/org/eclipse/digitaltwin/basyx/submodelrepository/feature/mqtt/MqttSubmodelRepository.java"},"deprecated":false,"digest":{"line_hashes":["203970367025078620644352576358313128894","136963657518193283574194826421301880193","21152198491869887627377524275748777775"],"threshold":0.9},"id":"CVE-2026-57898-888255a5","signature_type":"Line"},{"target":{"file":"basyx.aasrepository/basyx.aasrepository-core/src/test/java/org/eclipse/digitaltwin/basyx/aasrepository/AasRepositoryAasServiceWrapper.java"},"deprecated":false,"digest":{"line_hashes":["315448377766193501760118421047684159040","216652363588801456951652076324891911573","310652598087771887442411057630436039286"],"threshold":0.9},"id":"CVE-2026-57898-8951d985","signature_type":"Line","signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3"},{"deprecated":false,"digest":{"line_hashes":["153666011257703992597073068744209695836","140132081737269448258214385434518927293","259015123452235994753383598201156501839"],"threshold":0.9},"id":"CVE-2026-57898-953b7f23","signature_type":"Line","signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.aasservice/basyx.aasservice-feature-mqtt/src/main/java/org/eclipse/digitaltwin/basyx/aasservice/feature/mqtt/MqttAasService.java"}},{"deprecated":false,"digest":{"function_hash":"192024254923390693111434253334368309401","length":738},"id":"CVE-2026-57898-954c6926","signature_type":"Function","signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.submodelservice/basyx.submodelservice-backend/src/main/java/org/eclipse/digitaltwin/basyx/submodelservice/backend/SubmodelFileOperations.java","function":"setFileValue"}},{"deprecated":false,"digest":{"line_hashes":["203931042970099628200073295325552118954","304471911670795109572534134397055513555","214616858369582676612180730439925234629","306853766696700560111350164078105730071","150580889154962226399542239998140688587","213980647361917349855202642652195974564","140634637876918936293759528858178197693","220877927471213710193157317307553274318","334261165304565976718659717546203508870","33283309565843798570523019843038881954","44513887304192753476059317088834737997","162082760940381848778269908597093222319","178599285797056232027699648164146018363","107677460316870449286609779226194320926","229837561925148729763912387898086137880"],"threshold":0.9},"id":"CVE-2026-57898-959f20b0","signature_type":"Line","signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.submodelrepository/basyx.submodelrepository-http/src/main/java/org/eclipse/digitaltwin/basyx/submodelrepository/http/SubmodelRepositoryApiHTTPController.java"}},{"target":{"file":"basyx.aasservice/basyx.aasservice-backend/src/main/java/org/eclipse/digitaltwin/basyx/aasservice/backend/CrudAasService.java"},"deprecated":false,"digest":{"line_hashes":["274986887008714558256651711673586808733","37176945407193960582982277903025548023","125749807554323703348587513313041300800"],"threshold":0.9},"id":"CVE-2026-57898-a5d1b8cf","signature_type":"Line","signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3"},{"deprecated":false,"digest":{"line_hashes":["306247293293374558306390256966103909396","237341544095471219567752264717013574036","193296726153282130716410238617902839285","319857009604541795605184942193421508013"],"threshold":0.9},"id":"CVE-2026-57898-a7accc46","signature_type":"Line","signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.submodelservice/basyx.submodelservice-feature-operation-dispatching/src/main/java/org/eclipse/digitaltwin/basyx/submodelservice/feature/operationdispatching/AbstractSubmodelServiceDecorator.java"}},{"digest":{"line_hashes":["201262029267802085430221623374596446928","230602712466092389943374498761067850496","169767697544064747646364104303962920589","200656146513095832621278245196716685629","152135898082016732304969109787396304490","301393460301824837729599767591905713709","261636882729996641251438291332447362676","310021775691951125438859512025897339132","252008371399749457039802757903272843835","93982712088022561313801640087434911256","106428170490138490437199831205258153204"],"threshold":0.9},"id":"CVE-2026-57898-a8d8a74f","signature_type":"Line","signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.aasenvironment/basyx.aasenvironment-core/src/main/java/org/eclipse/digitaltwin/basyx/aasenvironment/base/DefaultAASEnvironment.java"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.aasrepository/basyx.aasrepository-feature-search/src/main/java/org/eclipse/digitaltwin/basyx/aasrepository/feature/search/SearchAasRepository.java"},"deprecated":false,"digest":{"line_hashes":["326298196779425334600991701347697195337","306831961641418344774174584433453801669","127722142903294133951776678587313497945"],"threshold":0.9},"id":"CVE-2026-57898-ad1599fa","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.submodelrepository/basyx.submodelrepository-core/src/test/java/org/eclipse/digitaltwin/basyx/submodelrepository/core/SubmodelRepositorySubmodelServiceWrapper.java"},"deprecated":false,"digest":{"line_hashes":["211326262846161413385592786929150143156","278305680408540425369012477172788528913","165575228756027124905362146757200376130"],"threshold":0.9},"id":"CVE-2026-57898-b11ef8b4","signature_type":"Line"},{"source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.submodelrepository/basyx.submodelrepository-feature-operation-delegation/src/main/java/org/eclipse/digitaltwin/basyx/submodelrepository/feature/operation/delegation/OperationDelegationSubmodelRepository.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["97328777217233334104391635601759239923","165035091532818462471065746998886691166","338045586794414702682852142501354769964"]},"id":"CVE-2026-57898-b211468c","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.aasrepository/basyx.aasrepository-backend/src/main/java/org/eclipse/digitaltwin/basyx/aasrepository/backend/CrudAasRepository.java"},"deprecated":false,"digest":{"line_hashes":["17695629667729960510799457953947765238","245951861709463696423061392111624764411","338803378882908568489704412935462731580"],"threshold":0.9},"id":"CVE-2026-57898-b3ad15c7","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.aasxfileserver/basyx.aasxfileserver-backend/src/main/java/org/eclipse/digitaltwin/basyx/aasxfileserver/backend/CrudAASXFileServer.java"},"deprecated":false,"digest":{"line_hashes":["257280040317316340210791723369903443960","236061016778223469772578270654032943788","171132183020726600886983521873628621264","112694441680156956459937058232164784656","48726607493405542895242265412019083742","215135555934950511072637282701782381660","239118689560457042095683496353730306349","116455605828796926981791049833316140145","76127877113050534771178906304636373417","109352949299685787051768588571909073311","170512589976855344723522445145075724281","152623508676581310883324063999897112326","46853867942053012823485848477262298408","301477570580923709578627794257120419467","330958178042968223346629207708875595322","166328335182751929717540034950433204643","272920213229839136001931726491471879082","170512589976855344723522445145075724281","232729712060399432306899565831876641513","134590948338006116904399524299032989606","220474685070279037836875334340666854803","100035634747647758344625585714792202272","174615772279543870770850456508765336758","208628879142284046434146457165669592716"],"threshold":0.9},"id":"CVE-2026-57898-b9a74a77","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.submodelrepository/basyx.submodelrepository-feature-kafka/src/main/java/org/eclipse/digitaltwin/basyx/submodelrepository/feature/kafka/KafkaSubmodelRepository.java"},"deprecated":false,"digest":{"line_hashes":["203970367025078620644352576358313128894","136963657518193283574194826421301880193","207273896266938863279428893948979661004"],"threshold":0.9},"id":"CVE-2026-57898-c955060e","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["326298196779425334600991701347697195337","306831961641418344774174584433453801669","127722142903294133951776678587313497945"],"threshold":0.9},"id":"CVE-2026-57898-cf3b57f2","signature_type":"Line","signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.aasrepository/basyx.aasrepository-feature-kafka/src/main/java/org/eclipse/digitaltwin/basyx/aasrepository/feature/kafka/KafkaAasRepository.java"}},{"id":"CVE-2026-57898-db9ab333","signature_type":"Line","signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.aasrepository/basyx.aasrepository-feature-mqtt/src/main/java/org/eclipse/digitaltwin/basyx/aasrepository/feature/mqtt/MqttAasRepository.java"},"deprecated":false,"digest":{"line_hashes":["326298196779425334600991701347697195337","306831961641418344774174584433453801669","127722142903294133951776678587313497945"],"threshold":0.9}},{"target":{"file":"basyx.submodelrepository/basyx.submodelrepository-http/src/main/java/org/eclipse/digitaltwin/basyx/submodelrepository/http/SubmodelRepositoryApiHTTPController.java","function":"getFileByPath"},"deprecated":false,"digest":{"function_hash":"289116630464788129968917015310104858582","length":496},"id":"CVE-2026-57898-db9e7887","signature_type":"Function","signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3"},{"signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.submodelservice/basyx.submodelservice-backend/src/main/java/org/eclipse/digitaltwin/basyx/submodelservice/backend/SubmodelFileOperations.java","function":"createOutputStream"},"deprecated":false,"digest":{"function_hash":"16639742246422141743492897479770036715","length":300},"id":"CVE-2026-57898-dd2608e7","signature_type":"Function"},{"id":"CVE-2026-57898-e419c891","signature_type":"Function","signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.submodelservice/basyx.submodelservice-backend/src/main/java/org/eclipse/digitaltwin/basyx/submodelservice/backend/CrudSubmodelService.java","function":"getExistingFilePath"},"deprecated":false,"digest":{"function_hash":"95740669094726468040637036719152129700","length":280}},{"digest":{"line_hashes":["288075063386682148735164814732525308191","165035091532818462471065746998886691166","21235249774354127337950332853690646901","221103928906771913793669738294349777400","34166343881000049807446601635374145624","73086941736542695748098217930359274660","323889073464331389644135711164163916852"],"threshold":0.9},"id":"CVE-2026-57898-e9d73a6d","signature_type":"Line","signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.submodelrepository/basyx.submodelrepository-feature-authorization/src/main/java/org/eclipse/digitaltwin/basyx/submodelrepository/feature/authorization/AuthorizedSubmodelRepository.java"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.aasenvironment/basyx.aasenvironment-core/src/main/java/org/eclipse/digitaltwin/basyx/aasenvironment/base/DefaultAASEnvironment.java","function":"addThumbnailToRelatedFiles"},"deprecated":false,"digest":{"length":527,"function_hash":"126904802778541390691499199205309223394"},"id":"CVE-2026-57898-f17edac5","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.common/basyx.filerepository-backend/src/main/java/org/eclipse/digitaltwin/basyx/core/filerepository/FileRepositoryHelper.java","function":"writeToFile"},"deprecated":false,"digest":{"function_hash":"29022351203080431256111276675514236242","length":244},"id":"CVE-2026-57898-f46acd10","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/eclipse-basyx/basyx-java-server-sdk/commit/fa9be4b6394d9ac27e4d2269e6360fe5b2c0f6c3","target":{"file":"basyx.submodelservice/basyx.submodelservice-backend/src/main/java/org/eclipse/digitaltwin/basyx/submodelservice/backend/CrudSubmodelService.java"},"deprecated":false,"digest":{"line_hashes":["280317550799281246153960907503867419846","301453863968212391370056188473222113766","215525656071107462649560453005870089714","336755312810925960286721681696254711863","218285860690025522928585398597654962768","68446035300870662860161030139757627138","247053933949197957820530050336103650489","330553663531934350663268110561392777469","60137760481573984085903527442918630672","25192117841079485141553408218227477022","202474399563483471682404466083557781796","273842206152033083487958320372064888484","146465409551697779767570108335662758635","284368639206927993798463194728142523146","327431233067179284316740634212127790603","120413428855292074771913323437033526632","78820858439077419357489626932187115839","243764696561433325308857197898806186989","16772716734091427799356058466116450084","1990735206864904354892564500916355135","210128579275682614182780068622264757940","311709746865480344886745433444217727992","2234869780411669148941549219884551341","319999188478737362405358437034804658568","161268398927917714033331782871878476594","337296008822435381807939462589345182553","237249127206233513548781288300076458044","39365516971998969458128170223341993622","105445704332236993247550757427951261866","220962420550040120153541573631500343203","87037562226522718941914917823412439256","270641684389339832125084358713202903405","76622381576297114952785595878933761692","212173157153113130734873865325091880601","24399666439296488215445334510494626333","191295132165660784856378183825987124338","134529022559812798491473284297252977575","248000957753051308091036371435475040600","11380206129756418438235855219321570457","146124532064753005265850683040381344040","289368911811457494553220184600127303992","104344638662758374829882166729973864951","236424003801836692832929863902371057036","246119831156725804484199954869016657878","111839162245050496756528420598222030775","76449122595446932578398829383016436384","170580379362104599652790689891851182712","231774810011472990841387898150356280615","139300460449770690441893699286278909630","14674957968197237394751251004420078708","46081662619029508132216955343425887454","200384268749153289163231263501558894715","265689844623845905178326255701017402366","150543173901712106306747514687997323746","179845571965219317039317622333039714127","50274550662962016490759411387041972240","162392410382971194900056841308804468412","207361569092713554472479747681123082522","132425582029619158339981590379637634165","6936732362102180078238176379774111448"],"threshold":0.9},"id":"CVE-2026-57898-f76db33d","signature_type":"Line"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"}]}