Insecure File Handling in Ground Station by SGoudelis
CVE-2026-53452

5.3MEDIUM

Key Information:

Vendor

Sgoudelis

Status
Ground-station
Vendor
CVE Published:
19 August 2026

What is CVE-2026-53452?

Ground Station, a browser-based application for satellite tracking and telemetry decoding, has a critical vulnerability in its file handling mechanism. Prior to version 0.4.13, the application allowed unauthenticated users to exploit the configure-sdr Socket.IO command by sending a recording path that lacked proper validation. This flaw enables attackers to read JSON metadata files and their associated data files outside of their intended directories. If the metadata file is structured as readable JSON and accompanied by a sibling .sigmf-data file, it can be returned in response to get-sdr-parameters without requiring authentication, potentially exposing sensitive information. This security lapse has been rectified in version 0.4.13.

Affected Version(s)

ground-station < 0.4.13

References

https://github.com/sgoudelis/ground-station/security/advi...
x_refsource_CONFIRM
https://github.com/sgoudelis/ground-station/commit/564990...
x_refsource_MISC
https://github.com/sgoudelis/ground-station/releases/tag/...
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.