A path traversal vulnerability in the Signal K server's resources API allows unauthenticated or low-privileged users to read, write, and delete files outside the intended storage directory. This includes reading the security.json file containing the JWT signing secret, enabling attackers to forge admin JWT tokens and gain administrative access. With admin privileges, attackers can create providers that execute arbitrary shell commands, resulting in remote code execution with server privileges. The vulnerability affects all signalk-server versions prior to 2.34.0 and resources-provider versions prior to 1.5.3. The issue is patched in versions 2.34.0 and 1.5.3.