What’s Vulnerable › Vulnerabilities

CVE-2025-34320: BASIS BBj < 25.00 Unauthenticated Arbitrary File Read RCE

• Severity: critical (CVSS 9.3 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-11-20 · updated 2026-10-18
• Weakness: CWE-22

Description

BASIS BBj versions prior to 25.00 contain a Jetty-served web endpoint that fails to properly validate or canonicalize input path segments. This allows unauthenticated directory traversal sequences to cause the server to read arbitrary system files accessible to the account running the service. Retrieved configuration artifacts may contain account credentials used for BBj Enterprise Manager; possession of these credentials enables administrative access and use of legitimate management functionality that can result in execution of system commands under the service account. Depending on the operating system and the privileges of the BBj service account, this issue may also allow access to other sensitive files on the host, including operating system or application data, potentially exposing additional confidential information.

Affected products

• BASIS International Ltd. BASIS BBj: before 25.00 — fixed in 25.00

How to fix

Upgrade to a fixed version: BASIS International Ltd. BASIS BBj 25.00. Check the vendor advisory for mitigations.

References

• https://myemail.constantcontact.com/BASIS-International-Ltd--releases-BBj---the-Barista--Application-Framework--and-AddonSoftware--by-Barista-version-25-00.html?soid=1103463119019&aid=WbfWkReLRVE
• https://www.vulncheck.com/advisories/basis-bbj-unauthenticated-arbitrary-file-read-rce

Get alerted when CVE-2025-34320 or the next vulnerability affects your stack