What is the CVSS score of CVE-2026-25228?

CVE-2026-25228 has a CVSS 3.1 base score of 5.0 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Windows are affected by CVE-2026-25228?

Organizations using a boat. should be aware of moderate risk from CVE-2026-25228, a path traversal vulnerability rated CVSS 5.0. This could allow unauthorized file access.. A patch is available.

Is there a public PoC exploit available for CVE-2026-25228?

Yes, a public proof-of-concept exploit is available for CVE-2026-25228. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-25228?

Within 30 days: Identify affected systems running a boat. and apply vendor patches as part of regular patch cycle. Review file handling controls.

Windows CVE-2026-25228

MEDIUM

Path Traversal (CWE-22)

2026-02-02 security-advisories@github.com

GHSA-vrhw-v2hw-jffx

Windows Path Traversal Signal K Server

5.0

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.0 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:01 vuln.today

PoC Detected

Feb 20, 2026 - 15:13 vuln.today

Public exploit code

Patch released

Feb 20, 2026 - 15:13 nvd

Patch available

CVE Published

Feb 02, 2026 - 23:16 nvd

MEDIUM 5.0

DescriptionGitHub Advisory

Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.20.3, a path traversal vulnerability in SignalK Server's applicationData API allows authenticated users on Windows systems to read, write, and list arbitrary files and directories on the filesystem. The validateAppId() function blocks forward slashes (/) but not backslashes (\), which are treated as directory separators by path.join() on Windows. This enables attackers to escape the intended applicationData directory. This vulnerability is fixed in 2.20.3.

AnalysisAI

Signal K Server versions prior to 2.20.3 on Windows contain a path traversal vulnerability in the applicationData API that allows authenticated users to read, write, and list arbitrary files by bypassing directory validation using backslashes. The vulnerability exists because the validateAppId() function only blocks forward slashes, allowing attackers to escape the intended applicationData directory through Windows path semantics. Public exploit code exists for this medium-severity flaw, and a patch is available in version 2.20.3.

Technical ContextAI

Classified as CWE-22 (Path Traversal). Affects Signal K Server. Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.20.3, a path traversal vulnerability in SignalK Server's applicationData API allows authenticated users on Windows systems to read, write, and list arbitrary files and directories on the filesystem. The validateAppId() function blocks forward slashes (/) but not backslashes (\), which are treated as directory separators by path.join() on Windows. This enables attackers to escape the intended applicationData

RemediationAI

A vendor patch is available — apply it immediately. Fixed in version 2.20.3.. Validate and sanitize file path inputs. Use allowlists. Restrict network access to the affected service where possible.