Threat database

ground-station versions before 0.8.0 contain an authentication bypass vulnerability in the setup.restore command that allows unauthenticated attackers to execute arbitrary SQL during first-run setup mode. Attackers can invoke setup.restore via Socket.IO to plant admin users and forged session tokens, then authenticate as administrator without credentials for complete application takeover.

CVE-2026-53451 is a critical path traversal vulnerability in sgoudelis ground-station prior to version 0.4.13. It allows unauthenticated attackers to write arbitrary files outside the intended directory by exploiting improper pathname limitation in a Socket.IO command. This can lead to remote code execution with service privileges via crafted logging configuration files, and may cause persistent service crashes. The issue is fixed in version 0.4.13.

CVE-2026-53452 is a path traversal vulnerability in sgoudelis ground-station prior to version 0.4.13. It allows unauthenticated attackers to read arbitrary files outside the intended directory by exploiting improper validation of a pathname used in SDR configuration commands. The vulnerability requires the presence of readable JSON metadata files and associated data files to disclose contents. This issue is fixed in version 0.4.13.