CVE-2025-34320 Details

A directory traversal vulnerability has been identified in BASIS BBj versions prior to 25.00. This issue arises from a Jetty-served web endpoint that does not properly validate or canonicalize input path segments. As a result, unauthenticated directory traversal sequences can be exploited to read arbitrary system files accessible to the account running the BBj service. The retrieved files may include configuration artifacts containing credentials for the BBj Enterprise Manager. With these credentials, an attacker can gain administrative access and execute system commands under the service account. Depending on the operating system and the privileges of the BBj service account, this vulnerability could also be used to access other sensitive files on the host, including operating system or application data, potentially exposing additional confidential information.

Users are advised to upgrade to BASIS BBj version 25.00 or later.