CVE-2026-25228

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25228", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-30T14:44:47.328Z", "datePublished": "2026-02-02T23:02:52.062Z", "dateUpdated": "2026-02-04T21:09:42.637Z"}, "containers": {"cna": {"title": "SignalK Server has Path Traversal leading to information disclosure", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/SignalK/signalk-server/security/advisories/GHSA-vrhw-v2hw-jffx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/SignalK/signalk-server/security/advisories/GHSA-vrhw-v2hw-jffx"}, {"name": "https://github.com/SignalK/signalk-server/commit/9bcf61c8fe2cb8a40998b913a02fb64dff9e86c7", "tags": ["x_refsource_MISC"], "url": "https://github.com/SignalK/signalk-server/commit/9bcf61c8fe2cb8a40998b913a02fb64dff9e86c7"}], "affected": [{"vendor": "SignalK", "product": "signalk-server", "versions": [{"version": "< 2.20.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-02T23:02:52.062Z"}, "descriptions": [{"lang": "en", "value": "Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.20.3, a path traversal vulnerability in SignalK Server's applicationData API allows authenticated users on Windows systems to read, write, and list arbitrary files and directories on the filesystem. The validateAppId() function blocks forward slashes (/) but not backslashes (\\), which are treated as directory separators by path.join() on Windows. This enables attackers to escape the intended applicationData directory. This vulnerability is fixed in 2.20.3."}], "source": {"advisory": "GHSA-vrhw-v2hw-jffx", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-04T21:09:33.563045Z", "id": "CVE-2026-25228", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T21:09:42.637Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25228", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-04T21:09:33.563045Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T21:09:39.736Z"}}], "cna": {"title": "SignalK Server has Path Traversal leading to information disclosure", "source": {"advisory": "GHSA-vrhw-v2hw-jffx", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "SignalK", "product": "signalk-server", "versions": [{"status": "affected", "version": "< 2.20.3"}]}], "references": [{"url": "https://github.com/SignalK/signalk-server/security/advisories/GHSA-vrhw-v2hw-jffx", "name": "https://github.com/SignalK/signalk-server/security/advisories/GHSA-vrhw-v2hw-jffx", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/SignalK/signalk-server/commit/9bcf61c8fe2cb8a40998b913a02fb64dff9e86c7", "name": "https://github.com/SignalK/signalk-server/commit/9bcf61c8fe2cb8a40998b913a02fb64dff9e86c7", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.20.3, a path traversal vulnerability in SignalK Server's applicationData API allows authenticated users on Windows systems to read, write, and list arbitrary files and directories on the filesystem. The validateAppId() function blocks forward slashes (/) but not backslashes (\\), which are treated as directory separators by path.join() on Windows. This enables attackers to escape the intended applicationData directory. This vulnerability is fixed in 2.20.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-02T23:02:52.062Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25228", "state": "PUBLISHED", "dateUpdated": "2026-02-04T21:09:42.637Z", "dateReserved": "2026-01-30T14:44:47.328Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-02T23:02:52.062Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "signalk-server", "vendor": "SignalK", "versions": [{"status": "affected", "version": "< 2.20.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:signalk:signal_k_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "A3B62A9F-E2CD-4CFB-9505-2D5F92A206AF", "versionEndExcluding": "2.20.3", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.20.3, a path traversal vulnerability in SignalK Server's applicationData API allows authenticated users on Windows systems to read, write, and list arbitrary files and directories on the filesystem. The validateAppId() function blocks forward slashes (/) but not backslashes (\\), which are treated as directory separators by path.join() on Windows. This enables attackers to escape the intended applicationData directory. This vulnerability is fixed in 2.20.3."}, {"lang": "es", "value": "Signal K Server es una aplicaci\u00f3n de servidor que se ejecuta en un concentrador central en un barco. Antes de la versi\u00f3n 2.20.3, una vulnerabilidad de salto de ruta en la API applicationData de SignalK Server permite a los usuarios autenticados en sistemas Windows leer, escribir y listar archivos y directorios arbitrarios en el sistema de archivos. La funci\u00f3n validateAppId() bloquea las barras diagonales (/) pero no las barras invertidas (\\), que son tratadas como separadores de directorio por path.join() en Windows. Esto permite a los atacantes escapar del directorio applicationData previsto. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 2.20.3."}], "id": "CVE-2026-25228", "lastModified": "2026-06-17T10:24:20.363", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25228", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-04T21:09:33.563045Z", "version": "2.0.3"}}]}, "published": "2026-02-02T23:16:10.080", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/SignalK/signalk-server/commit/9bcf61c8fe2cb8a40998b913a02fb64dff9e86c7"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/SignalK/signalk-server/security/advisories/GHSA-vrhw-v2hw-jffx"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T00:28:11.590420+00:00", "value": {"mitigation_remediation": ["Upgrade Signal K Server to version 2.20.3 or later to eliminate the path traversal vulnerability.", "Restrict authentication to trusted users only and review the applicationData API permissions to prevent unauthorized file access.", "If an upgrade cannot be performed immediately, consider applying OS\u2011level access controls to the Signal K Server process directory to limit file system visibility and deny directory traversal attempts by non\u2011privileged users."], "summary": {"action": "Apply patch", "impact": "Information disclosure and potential manipulation of files via path traversal"}, "threat_synthesis": {"affected_systems": "SignalK Server versions prior to 2.20.3 on Windows operating systems are affected. The vulnerability is fixed in version 2.20.3 and later, so upgrading to at least that release removes the risk.", "description_and_impact": "Signal K Server's applicationData API contains a path traversal flaw that allows authenticated users on Windows systems to read, write, and list arbitrary files and directories. The validateAppId() function blocks forward slashes but does not remove backslashes, which on Windows are interpreted as directory separators by path.join(), enabling an attacker to escape the intended applicationData directory. This flaw can lead to accidental or intentional disclosure of sensitive data and unauthorized modification of files, undermining confidentiality and integrity of the vessel\u2019s data environment.", "risk_and_exploitability": "The CVSS score of 5 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation. The flaw requires the attacker to be an authenticated user on a Windows system, but once those conditions are met, the attacker can traverse directories and access or modify any files the process can read or write, potentially compromising critical operational data."}}}}, "created": "2026-02-04T12:17:53.690154+00:00", "updated": "2026-04-18T00:30:25.717380+00:00", "vendors": ["signalk", "signalk$PRODUCT$signal_k_server", "signalk$PRODUCT$signalk-server"]}