Description

Ground Station is a browser-based suite for satellite tracking, SDR reception, hardware control, and telemetry decoding. Prior to version 0.4.13, the unauthenticated configure-sdr Socket.IO command accepts a recordingPath for the sigmf-playback SDR and backend/handlers/entities/sdr.py stores it without validation before backend/hardware/sigmfprobe.py opens the path without enforcing containment. An absolute path or parent-directory escape ending in .sigmf-meta is parsed as JSON and returned in reply["data"]["metadata"] by the get-sdr-parameters flow. Exploitation requires the metadata file to be readable JSON and to have a sibling .sigmf-data file, but it can disclose contents outside backend/data/recordings without authentication. This issue is fixed in version 0.4.13.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-19T15:17:10.280Z",
  "pubdate": "2026-08-19T15:17:10.280Z",
  "executiveSummary": "Ground Station, a browser-based suite for satellite tracking, SDR reception, hardware control, and telemetry decoding prior to version 0.4.13, suffers from an unauthenticated arbitrary file read vulnerability via path traversal. The flaw stems from insufficient input validation of the recordingPath parameter processed by the configure-sdr Socket.IO command. An unauthenticated attacker can exploit this weakness to read and exfiltrate the contents of arbitrary JSON-formatted metadata files outside the intended backend/data/recordings directory. Successful exploitation requires the targeted file to be valid JSON and accompanied by a sibling .sigmf-data file. The vulnerability poses significant risk to confidentiality by exposing sensitive system or telemetry data without requiring authentication or prior privileges.",
  "technicalDetails": "The vulnerability resides in the backend/handlers/entities/sdr.py component and the backend/hardware/sigmfprobe.py module of the Ground Station application. Specifically, the unauthenticated configure-sdr Socket.IO command accepts a recordingPath parameter designated for the sigmf-playback SDR. The vulnerable backend component stores this path without performing input validation or enforcing path containment. Subsequently, backend/hardware/sigmfprobe.py opens the provided path directly. Because directory traversal sequences or absolute paths are permitted, an attacker can specify paths outside the intended storage boundary, provided the path or a parent-directory escape ends with the .sigmf-meta extension. The underlying engine parses this file as JSON and exposes the parsed contents via reply['data']['metadata'] during the get-sdr-parameters workflow. To successfully exploit this mechanism, the targeted metadata file must be readable JSON and possess a corresponding sibling .sigmf-data file on the filesystem. Network exposure affects any deployment where the Socket.IO service is reachable, and the attack requires zero authentication or elevated privileges."
}