EUVD-2026-62495Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-accessible unauthenticated Socket.IO endpoint with no user interaction; confidentiality impact is low given JSON-only and sibling-file constraints; no integrity or availability impact applies.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
Ground Station is a browser-based suite for satellite tracking, SDR reception, hardware control, and telemetry decoding. Prior to version 0.4.13, the unauthenticated configure-sdr Socket.IO command accepts a recordingPath for the sigmf-playback SDR and backend/handlers/entities/sdr.py stores it without validation before backend/hardware/sigmfprobe.py opens the path without enforcing containment. An absolute path or parent-directory escape ending in .sigmf-meta is parsed as JSON and returned in reply["data"]["metadata"] by the get-sdr-parameters flow. Exploitation requires the metadata file to be readable JSON and to have a sibling .sigmf-data file, but it can disclose contents outside backend/data/recordings without authentication. This issue is fixed in version 0.4.13.
AnalysisAI
Unauthenticated path traversal in Ground Station before v0.4.13 allows remote attackers to read arbitrary JSON-parseable files outside the intended recordings directory via the Socket.IO configure-sdr command. The sigmf-playback SDR type accepts an unsanitized recordingPath parameter that is stored verbatim and later opened by the sigmfprobe backend, enabling absolute-path or directory-traversal payloads to escape backend/data/recordings and return file contents to the caller. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network access to the Ground Station Socket.IO endpoint - the configure-sdr command requires no authentication (CVSS PR:N confirmed). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.3 Medium score (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) accurately captures the essential risk: the attack is network-accessible with no authentication or user interaction required, but confidentiality impact is limited and the exploitation conditions are materially constraining. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker with network access to the Ground Station Socket.IO endpoint sends a configure-sdr command targeting the sigmf-playback SDR type, supplying a recordingPath value such as /var/app/config/secrets.json (where a secrets.json.sigmf-data sibling exists) or a traversal sequence like ../../app_config.sigmf-meta. A subsequent get-sdr-parameters call causes the backend to open, parse, and return the targeted file's JSON contents in the API response. … |
| Remediation | Upgrade to Ground Station v0.4.13, which introduces the pathguard.py module that resolves and validates all recordingPath values against allowed roots before any file access occurs. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ground Station
View allUnauthenticated remote code execution in sgoudelis Ground Station before 0.4.13 arises from chaining a path-traversal fi
Unauthenticated denial-of-service in sgoudelis/Ground Station prior to 0.6.0 allows any network peer to forcibly termina
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today