VYPR
Get started
← All advisories
Moderate severityOSV Advisory· Published Feb 2, 2026· Updated Feb 4, 2026

SignalK Server has Path Traversal leading to information disclosure

CVE-2026-25228

Description

Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.20.3, a path traversal vulnerability in SignalK Server's applicationData API allows authenticated users on Windows systems to read, write, and list arbitrary files and directories on the filesystem. The validateAppId() function blocks forward slashes (/) but not backslashes (\), which are treated as directory separators by path.join() on Windows. This enables attackers to escape the intended applicationData directory. This vulnerability is fixed in 2.20.3.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
signalk-servernpm
< 2.20.32.20.3

Affected products

1

Patches

1
9bcf61c8fe2c

fix(applicationData): sanitize applicationData paths

https://github.com/SignalK/signalk-serverTeppo KurkiJan 31, 2026via ghsa
commit
1 file changed · +15 −4
  • src/interfaces/applicationData.js+15 −4 modified
    @@ -218,7 +218,11 @@ module.exports = function (app) {
   }
 
   function validateAppId(appid) {
-    return appid.length < 30 && appid.indexOf('/') === -1 ? appid : null
+    return appid.length < 30 &&
+      appid.indexOf('/') === -1 &&
+      appid.indexOf('\\') === -1
+      ? appid
+      : null
   }
 
   function validateVersion(version) {
@@ -236,10 +240,17 @@ module.exports = function (app) {
   }
 
   function pathForApplicationData(req, appid, version, isUser) {
-    return path.join(
-      dirForApplicationData(req, appid, isUser),
-      `${version}.json`
+    const filePath = path.normalize(
+      path.join(dirForApplicationData(req, appid, isUser), `${version}.json`)
     )
+    const configPath = path.resolve(app.config.configPath)
+    const resolvedPath = path.resolve(filePath)
+
+    if (!resolvedPath.startsWith(configPath)) {
+      throw new Error('Invalid path: outside configuration directory')
+    }
+
+    return filePath
   }
 
   function saveApplicationData(req, appid, version, isUser, data, callback) {

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.