CVE-2026-53451: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in sgoudelis ground-station

The vulnerability exists in sgoudelis ground-station versions before 0.4.13, where the unauthenticated save-waterfall-snapshot Socket.IO command accepts attacker-controlled snapshotName input. This input is passed to a function that uses os.path.join without restricting absolute paths or parent-directory traversal, enabling writing files outside the designated snapshots directory. An attacker can write a malicious YAML logging configuration file that includes a callable factory. By using another unauthenticated operation, update-app-config, the attacker sets the logging configuration to this malicious file and invokes restart_service. During restart, the logging configuration is loaded and executed with service privileges, allowing arbitrary code execution and potentially causing a persistent crash loop. The vulnerability is addressed in version 0.4.13.

An unauthenticated attacker can write arbitrary files to the server filesystem outside the intended directory, leading to remote code execution with service-level privileges. This can compromise confidentiality, integrity, and availability of the affected system. The vulnerability has a CVSS score of 9.8 (critical). There are no known exploits in the wild at this time.

Upgrade sgoudelis ground-station to version 0.4.13 or later, where this vulnerability is fixed. No other mitigations are indicated by the vendor advisory.