EUVD-2026-62495Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-accessible unauthenticated Socket.IO endpoint with no user interaction; confidentiality impact is low given JSON-only and sibling-file constraints; no integrity or availability impact applies.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Ground Station is a browser-based suite for satellite tracking, SDR reception, hardware control, and telemetry decoding. Prior to version 0.4.13, the unauthenticated configure-sdr Socket.IO command accepts a recordingPath for the sigmf-playback SDR and backend/handlers/entities/sdr.py stores it without validation before backend/hardware/sigmfprobe.py opens the path without enforcing containment. An absolute path or parent-directory escape ending in .sigmf-meta is parsed as JSON and returned in reply["data"]["metadata"] by the get-sdr-parameters flow. Exploitation requires the metadata file to be readable JSON and to have a sibling .sigmf-data file, but it can disclose contents outside backend/data/recordings without authentication. This issue is fixed in version 0.4.13.
AnalysisAI
Unauthenticated path traversal in Ground Station before v0.4.13 allows remote attackers to read arbitrary JSON-parseable files outside the intended recordings directory via the Socket.IO configure-sdr command. The sigmf-playback SDR type accepts an unsanitized recordingPath parameter that is stored verbatim and later opened by the sigmfprobe backend, enabling absolute-path or directory-traversal payloads to escape backend/data/recordings and return file contents to the caller. No public exploit has been identified at time of analysis; a vendor-released patch exists as of version 0.4.13.
Technical ContextAI
Ground Station is a Python/Socket.IO backend application for satellite tracking and Software Defined Radio operations, identified by CPE cpe:2.3:a:sgoudelis:ground-station:*:*:*:*:*:*:*:*. The vulnerability is rooted in CWE-22 (Improper Limitation of a Pathname to a Restricted Directory): the configure-sdr Socket.IO command, accessible without authentication, accepts a recordingPath parameter that backend/handlers/entities/sdr.py stores without validation. When the get-sdr-parameters flow is subsequently invoked, backend/hardware/sigmfprobe.py opens the stored path directly, reads it as JSON, and returns the parsed structure in reply['data']['metadata']. The pre-patch code resolved relative paths to backend/data/recordings but performed no canonicalization or boundary enforcement for absolute paths or traversal sequences (e.g., ../../). The fix in v0.4.13 introduces backend/common/pathguard.py, which uses Python's Path.resolve() and Path.relative_to() to enforce containment within backend/data/recordings or additional roots declared via the GS_SIGMF_ALLOWED_DIRS environment variable.
RemediationAI
Upgrade to Ground Station v0.4.13, which introduces the pathguard.py module that resolves and validates all recordingPath values against allowed roots before any file access occurs. The patched release is available at https://github.com/sgoudelis/ground-station/releases/tag/v0.4.13 and the specific fix commit is at https://github.com/sgoudelis/ground-station/commit/5649905f1021155933463a54a76030924adffb9d. If immediate upgrade is not possible, place the Ground Station Socket.IO endpoint behind an authenticating reverse proxy to enforce network-level access control - note this does not eliminate the path traversal for authenticated users who should not be trusted. Alternatively, firewall rules restricting the Socket.IO port to known trusted hosts reduce exposure at the cost of removing remote legitimate access. The GS_SIGMF_ALLOWED_DIRS environment variable, introduced in v0.4.13, can be used post-upgrade to extend permitted recording directories for non-default storage configurations without re-opening the traversal vulnerability.
More in Ground Station
View allUnauthenticated remote code execution in sgoudelis Ground Station before 0.4.13 arises from chaining a path-traversal fi
Unauthenticated attackers with network access to a ground-station instance running a version before 0.8.0 can achieve co
Unauthenticated denial-of-service in sgoudelis/Ground Station prior to 0.6.0 allows any network peer to forcibly termina
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today