Path Traversal Vulnerability in Signal K Server by Signal K

CVE-2026-25228

What is CVE-2026-25228?

Signal K Server, designed for managing data in marine applications, exhibits a path traversal vulnerability in its applicationData API for versions prior to 2.20.3. This flaw permits authenticated users on Windows systems to exploit the application by reading, writing, and listing arbitrary files and directories beyond the intended applicationData scope. The root cause lies in the validateAppId() method, which inadequately sanitizes input by failing to block backslashes, leading to potential unauthorized file system access. Users are advised to upgrade to version 2.20.3 or later to mitigate this issue.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References