Path Traversal Vulnerability in Signal K Server
CVE-2026-123807
What is CVE-2026-123807?
The Signal K Server has a path traversal vulnerability affecting versions from 2.0.0 to 2.34.0 and the @signalk/resources-provider from 1.0.0 to 1.5.3. An attacker can exploit the v2 REST route GET /signalk/v2/api/resources/:resourceType/:resourceId by injecting a malicious resourceId that bypasses the intended resource directory. This vulnerability allows unauthorized access to arbitrary JSON files on the server, which could include sensitive information. Additionally, related PUT and DELETE operations can manipulate files beyond the designated storage root, potentially exposing or altering critical server data. If the allow_readonly option is enabled, unauthorized users can read sensitive files without authentication, including the security.json file that may disclose critical secrets such as JWT signing keys. An attacker gaining administrative access could execute commands with server privileges, drastically compromising the integrity and security of the hosting system. Updates to Signal K Server version 2.34.0 and @signalk/resources-provider version 1.5.3 are recommended to mitigate this issue.
Affected Version(s)
resources-provider >= 1.0.0, < 1.5.3
signalk-server >= 2.0.0, < 2.34.0