CVE-2026-53452
Received Received - Intake

Path Traversal in Ground Station

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
Ground Station is a browser-based suite for satellite tracking, SDR reception, hardware control, and telemetry decoding. Prior to version 0.4.13, the unauthenticated configure-sdr Socket.IO command accepts a recordingPath for the sigmf-playback SDR and backend/handlers/entities/sdr.py stores it without validation before backend/hardware/sigmfprobe.py opens the path without enforcing containment. An absolute path or parent-directory escape ending in .sigmf-meta is parsed as JSON and returned in reply["data"]["metadata"] by the get-sdr-parameters flow. Exploitation requires the metadata file to be readable JSON and to have a sibling .sigmf-data file, but it can disclose contents outside backend/data/recordings without authentication. This issue is fixed in version 0.4.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-53452
EUVD
EUVD-2026-62495

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sgoudelis ground-station 0.4.13

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an unauthenticated out-of-containment file read vulnerability in the ground-station software. It allows an attacker to read arbitrary files on the system by exploiting improper path handling in the sigmfplayback functionality. The flaw occurs when the configure-sdr command accepts a recordingPath parameter without validation, enabling path traversal attacks.

Detection Guidance

To detect this vulnerability, check if your ground-station instance is running a version prior to 0.4.13. Test by sending a configure-sdr command with a recordingPath pointing to a sensitive file ending in .sigmf-meta. If the server responds with the file contents, the system is vulnerable.

Impact Analysis

An attacker could access sensitive files outside the intended recordings directory, potentially exposing configuration files, logs, or other confidential data. This could lead to information disclosure, privilege escalation, or further exploitation of the system if combined with other vulnerabilities.

Compliance Impact

This vulnerability could violate compliance requirements by exposing sensitive data to unauthorized parties. GDPR may be impacted if personal data is disclosed, while HIPAA could be violated if protected health information is exposed. Organizations using this software must address this flaw to maintain regulatory compliance.

Mitigation Strategies

Upgrade ground-station to version 0.4.13 or later. Ensure the recordingPath parameter is validated to prevent path traversal. Restrict access to the configure-sdr endpoint and enforce authentication for sensitive operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53452. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart