CVE-2026-53452: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in sgoudelis ground-station
Description
CVE-2026-53452 is a path traversal vulnerability in sgoudelis ground-station prior to version 0.4.13. It allows unauthenticated attackers to read arbitrary files outside the intended directory by exploiting improper validation of a pathname used in SDR configuration commands. The vulnerability requires the presence of readable JSON metadata files and associated data files to disclose contents. This issue is fixed in version 0.4.13.
CVSS v3.1
Score 5.3medium
Affected software
sgoudelis
ground-station
pkg:github/sgoudelis/ground-stationRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability exists in the configure-sdr Socket.IO command of sgoudelis ground-station before version 0.4.13. The command accepts a recordingPath parameter that is stored without validation and later opened without enforcing directory containment. An attacker can supply an absolute or parent-directory escape path ending with .sigmf-meta, which is parsed as JSON and returned in the get-sdr-parameters flow. This allows disclosure of file contents outside the backend/data/recordings directory without authentication, provided the metadata file is valid JSON and has a sibling .sigmf-data file. The flaw is addressed in version 0.4.13.
Potential Impact
An unauthenticated attacker can read arbitrary files outside the intended recordings directory, potentially exposing sensitive information. The impact is limited to information disclosure (confidentiality loss) without integrity or availability effects. The CVSS score is 5.3 (medium severity).
Mitigation Recommendations
Upgrade to sgoudelis ground-station version 0.4.13 or later, where this path traversal vulnerability is fixed. No other mitigation is indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-09T16:31:21.494Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a85c70bacd9273b493b308c
Added to database: 08/19/2026, 15:08:59 UTC
Last enriched: 09/11/2026, 08:18:12 UTC
Last updated: 10/04/2026, 10:02:28 UTC
Views: 53
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.