CVE-2026-25228CWE-22

SignalK Server has Path Traversal leading to information disclosure

Medium · published February 2, 2026

CVSS v3.1
5.0
EPSS
0%
Percentile
36.5
In the wild
Unconfirmed
What it is

Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.20.3, a path traversal vulnerability in SignalK Server's applicationData API allows authenticated users on Windows systems to read, write, and list arbitrary files and directories on the filesystem. The validateAppId() function blocks forward slashes (/) but not backslashes (\), which are treated as directory separators by path.join() on Windows. This enables attackers to escape the intended applicationData directory. This vulnerability is fixed in 2.20.3.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00432 · 36.5th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-02-02T23:02Z
EPSS history
Timeline
  • 02 FEB 23:02Z
    SignalK Server has Path Traversal leading to information disclosure
    cvelistv5