The vulnerability exists in the sgoudelis ground-station software before version 0.4.13. An unauthenticated attacker can exploit the save-waterfall-snapshot Socket.IO command by supplying a crafted snapshotName that allows absolute path or parent-directory traversal. This leads to writing attacker-controlled base64-decoded data outside the backend/data/snapshots directory. The attacker can write a malicious YAML logging configuration file containing a logging.config.dictConfig callable factory. Using the unauthenticated update-app-config operation, the attacker sets log_config to this malicious file and invokes restart_service. During restart, the logging configuration is loaded and executed with service privileges, enabling remote code execution and potentially causing a persistent crash loop. The vulnerability is addressed in version 0.4.13.

Successful exploitation allows unauthenticated remote attackers to write arbitrary files on the server, execute arbitrary code with service privileges via malicious logging configuration, and cause persistent service crashes. This leads to full compromise of the affected system and denial of service.

Upgrade to sgoudelis ground-station version 0.4.13 or later, where this vulnerability is fixed. No other mitigation or workaround is indicated in the available data.