CVE-2026-53451
Received Received - Intake

Path Traversal in Ground Station

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
Ground Station is a browser-based suite for satellite tracking, SDR reception, hardware control, and telemetry decoding. Prior to version 0.4.13, the unauthenticated save-waterfall-snapshot Socket.IO command passes attacker-controlled snapshotName input from backend/handlers/entities/sdr.py to backend/server/snapshots.py, where os.path.join permits an absolute path or parent-directory traversal and writes attacker-controlled base64-decoded bytes outside backend/data/snapshots. An attacker can write a logging YAML file containing a logging.config.dictConfig callable factory, use the unauthenticated update-app-config operation to set log_config to that file, and invoke restart_service. During restart, backend/common/logger.py passes the YAML through resolve_log_config_path(), yaml.safe_load(), and logging.config.dictConfig(), which executes the factory with service privileges and can also cause a persistent crash loop. This issue is fixed in version 0.4.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-53451
EUVD
EUVD-2026-62497

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
ground_station ground_station 0.4.13
sgoudelis ground_station to 0.4.13 (exc)
sgoudelis ground_station 0.4.13

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a critical unauthenticated arbitrary file write vulnerability in the ground-station software. It allows attackers to write files to any location on the system by exploiting path traversal in the save-waterfall-snapshot command. The flaw stems from unsanitized snapshotName input passed to os.path.join, enabling directory escape via leading slashes or parent directory sequences. Attackers can write a malicious logging YAML file, update the application configuration to point to this file, and trigger a service restart. During restart, the logging system executes the malicious YAML, leading to arbitrary command execution with root privileges and persistent denial-of-service due to crash loops.

Detection Guidance

Check for unauthorized file writes in the Ground Station snapshots directory or system logs. Look for unexpected YAML files in backend/data/snapshots or logs containing logging.config.dictConfig calls. Inspect network traffic for unauthenticated Socket.IO commands like save-waterfall-snapshot with suspicious snapshotName parameters.

Impact Analysis

This vulnerability allows attackers to execute arbitrary commands on your system with root privileges without authentication. They can steal sensitive data, install malware, modify system files, or cause persistent crashes that disrupt service. The attack requires no user interaction and can be performed remotely, making it highly dangerous for any system running vulnerable versions of ground-station.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and system integrity. GDPR requires protecting personal data and ensuring system security to prevent unauthorized access. HIPAA mandates safeguarding protected health information and maintaining system availability. The arbitrary file write and remote code execution capabilities could lead to data breaches, unauthorized data access, or service disruption, resulting in non-compliance and potential legal penalties.

Mitigation Strategies

Upgrade to Ground Station version 0.4.13 or later. If upgrading is not immediately possible, restrict write access to backend/data/snapshots, disable unauthenticated Socket.IO commands, and audit log_config settings to prevent unauthorized file writes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53451. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart