EUVD-2026-62497Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable Socket.IO commands (AV:N/PR:N/UI:N) chain deterministically to code execution and crash loop, yielding AC:L with full C/I/A impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Ground Station is a browser-based suite for satellite tracking, SDR reception, hardware control, and telemetry decoding. Prior to version 0.4.13, the unauthenticated save-waterfall-snapshot Socket.IO command passes attacker-controlled snapshotName input from backend/handlers/entities/sdr.py to backend/server/snapshots.py, where os.path.join permits an absolute path or parent-directory traversal and writes attacker-controlled base64-decoded bytes outside backend/data/snapshots. An attacker can write a logging YAML file containing a logging.config.dictConfig callable factory, use the unauthenticated update-app-config operation to set log_config to that file, and invoke restart_service. During restart, backend/common/logger.py passes the YAML through resolve_log_config_path(), yaml.safe_load(), and logging.config.dictConfig(), which executes the factory with service privileges and can also cause a persistent crash loop. This issue is fixed in version 0.4.13.
AnalysisAI
Unauthenticated remote code execution in sgoudelis Ground Station before 0.4.13 arises from chaining a path-traversal file write with an insecure logging-config reload. The unauthenticated save-waterfall-snapshot Socket.IO command lets a remote attacker write attacker-controlled bytes anywhere on disk, then use the equally unauthenticated update-app-config and restart_service commands to load a malicious logging YAML that executes a Python callable factory with service privileges (or forces a persistent crash loop). Rated CVSS 9.8; no public exploit identified at time of analysis, though the fixing commit and advisory describe the full exploit chain.
Technical ContextAI
Ground Station is a browser-based suite (Python/Socket.IO backend) for satellite tracking, SDR reception, hardware control, and telemetry decoding. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory): in backend/server/snapshots.py the snapshotName from the SDR handler (backend/handlers/entities/sdr.py) was passed to os.path.join, which returns an absolute path unchanged and honors '../' sequences, so writes escaped the intended backend/data/snapshots directory. The second stage abuses Python's logging.config.dictConfig, which by design can instantiate arbitrary '()' callable factories from a config dict; because restart_service reloads a YAML log config via resolve_log_config_path(), yaml.safe_load(), and dictConfig() in backend/common/logger.py, an attacker-planted config file turns configuration reload into arbitrary code execution. The fix introduces backend/common/pathguard.py with allowlist roots and ensure_path_in_allowed_roots()/get_snapshots_root() to confine writes. CPE cpe:2.3:a:sgoudelis:ground-station identifies the single affected application.
RemediationAI
Upgrade to Ground Station 0.4.13, which adds backend/common/pathguard.py and confines snapshot/recording writes to allowlisted roots (Vendor-released patch: 0.4.13; see https://github.com/sgoudelis/ground-station/releases/tag/v0.4.13 and advisory GHSA-q35x-w3h6-36w8). Until patched, the highest-value compensating control is to remove network exposure of the Socket.IO interface: bind the service to localhost or place it behind an authenticating reverse proxy / VPN so the unauthenticated save-waterfall-snapshot, update-app-config, and restart_service commands are unreachable - the trade-off is loss of remote browser access. Additionally restrict the OS account running the backend to least privilege and make backend/data (and the log-config path used by resolve_log_config_path) non-writable by untrusted input where feasible, and monitor for unexpected files written outside backend/data/snapshots; these reduce blast radius but do not close the traversal by themselves, so patching remains essential.
More in Ground Station
View allUnauthenticated attackers with network access to a ground-station instance running a version before 0.8.0 can achieve co
Unauthenticated denial-of-service in sgoudelis/Ground Station prior to 0.6.0 allows any network peer to forcibly termina
Unauthenticated path traversal in Ground Station before v0.4.13 allows remote attackers to read arbitrary JSON-parseable
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today