The vulnerability exists in the sgoudelis ground-station software before version 0.4.13. The unauthenticated configure-sdr Socket.IO command accepts a recordingPath parameter for the sigmf-playback software-defined radio (SDR). This path is stored without validation in backend/handlers/entities/sdr.py and later opened without containment enforcement in backend/hardware/sigmfprobe.py. An attacker can supply an absolute or parent-directory escape path ending in .sigmf-meta, which is parsed as JSON and returned in the get-sdr-parameters flow. Exploitation requires the metadata file to be readable JSON and to have a sibling .sigmf-data file. This allows disclosure of file contents outside the backend/data/recordings directory without authentication. The issue is resolved in version 0.4.13.

An unauthenticated attacker can read arbitrary files outside the intended directory, potentially disclosing sensitive information. The vulnerability does not allow modification or denial of service. The CVSS v3.1 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, and confidentiality impact only.

Upgrade sgoudelis ground-station to version 0.4.13 or later, where this path traversal vulnerability is fixed. No other mitigation or workaround is indicated by the vendor advisory. Patch status is confirmed fixed in 0.4.13.