CVE-2026-53452: falha de média gravidade em sgoudelis ground-station
Ground Station: Unauthenticated out-of-containment file read via `sigmfplayback` `recordingPath`
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.5%
Ground Station is a browser-based suite for satellite tracking, SDR reception, hardware control, and telemetry decoding. Prior to version 0.4.13, the unauthenticated configure-sdr Socket.IO command accepts a recordingPath for the sigmf-playback SDR and backend/handlers/entities/sdr.py stores it without validation before backend/hardware/sigmfprobe.py opens the path without enforcing containment. An absolute path or parent-directory escape ending in .sigmf-meta is parsed as JSON and returned in reply["data"]["metadata"] by the get-sdr-parameters flow. Exploitation requires the metadata file to be readable JSON and to have a sibling .sigmf-data file, but it can disclose contents outside backend/data/recordings without authentication. This issue is fixed in version 0.4.13.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
sgoudelis · ground-stationCVEs relacionadas — sgoudelis ground-station
No mesmo produto, das mais perigosas para as menos.
CVE-2026-53451CRITICALGround Station: Unauthenticated arbitrary file write (path traversal) in save-waterfall-snapshot leads to remote code executionEPSS 1.1%CVE-2026-103244CRITICALground-station before 0.8.0 Authentication Bypass via setup.restoreEPSS 0.6%CVE-2026-123485HIGHGround Station 0.6.0 before 0.8.20 Credential Disclosure via get-orbital-sourcesEPSS —