Path Traversal in Signal K Server Allows Arbitrary File Access

Publication date: 2026-02-02

Last updated on: 2026-02-20

Assigner: GitHub, Inc.

Description

Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.20.3, a path traversal vulnerability in SignalK Server's applicationData API allows authenticated users on Windows systems to read, write, and list arbitrary files and directories on the filesystem. The validateAppId() function blocks forward slashes (/) but not backslashes (\), which are treated as directory separators by path.join() on Windows. This enables attackers to escape the intended applicationData directory. This vulnerability is fixed in 2.20.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-02-02

Last Modified

2026-02-20

Generated

2026-07-06

AI Q&A

2026-02-03

EPSS Evaluated

2026-07-05

NVD

CVE-2026-25228

Affected Vendors & Products

Vendor	Product	Version / Range
signalk	signal_k_server	to 2.20.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a path traversal issue in the Signal K Server application prior to version 2.20.3. It affects the applicationData API and allows authenticated users on Windows systems to read, write, and list arbitrary files and directories outside the intended directory. The problem arises because the validateAppId() function blocks forward slashes (/) but not backslashes (\), which Windows treats as directory separators. This allows attackers to escape the intended applicationData directory and access other parts of the filesystem.

Impact Analysis

This vulnerability can allow an authenticated user on a Windows system to access, modify, or list files and directories outside the intended applicationData directory. This could lead to unauthorized disclosure of sensitive information, modification of important files, or other unintended actions on the filesystem, potentially compromising the integrity and confidentiality of data on the system.

Mitigation Strategies

Upgrade Signal K Server to version 2.20.3 or later, as this version contains the fix for the path traversal vulnerability. Additionally, restrict authenticated user permissions on Windows systems to limit access to the filesystem and monitor for any unusual file access patterns.

Hi! I’m here to help you understand CVE-2026-25228. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70