Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-25228: SignalK Server lets logged‑in users view or change any file

CVE-2026-25228 · published 9 months ago

Summary

If you run SignalK Server version before 2.20.3 on Windows, a signed‑in user can move past the intended folder and read, write, or list any files on the computer. The problem is caused by the program treating backslash characters as folder separators. Updating SignalK Server to version 2.20.3 or later removes this risk.

What to do

Update sbender signalk-server to version 2.20.3.
Update signalk signal_k_server to version 2.20.3 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	signalk	signal_k_server	< 2.20.3 `cpe:2.3:a:signalk:signal_k_server::::::::`
npm	sbender	signalk-server	<= 2.20.2 Fix: upgrade to 2.20.3

Original advisory text

SignalK Server has Path Traversal leading to information disclosure

Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.20.3, a path traversal vulnerability in SignalK Server's applicationData API allows authenticated users on Windows systems to read, write, and list arbitrary files and directories on the filesystem. The validateAppId() function blocks forward slashes (/) but not backslashes (\), which are treated as directory separators by path.join() on Windows. This enables attackers to escape the intended applicationData directory. This vulnerability is fixed in 2.20.3.

References

https://github.com/advisories/GHSA-vrhw-v2hw-jffx
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25228... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-25228 Vendor Advisory
https://github.com/SignalK/signalk-server/commit/9bcf61c8fe2cb8a40998b913a02fb64... Patch
https://github.com/SignalK/signalk-server/security/advisories/GHSA-vrhw-v2hw-jff... Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

5.0 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-22Path Traversal

Timeline

Published2 Feb 2026

Updated3 Nov 2026

First seen6 Mar 2026

Sources

CVE-2026-25228 · NVD

GHSA-vrhw-v2hw-jffx · GHSA

CVE-2026-25228 · OSV

Track software like this

Free during beta