CVE-2025-70084: OpenSatKit Path Traversal Vulnerability

CVE-2025-70084 Overview

CVE-2025-70084 is a directory traversal vulnerability affecting OpenSatKit version 2.2.1. This vulnerability allows remote attackers to gain unauthorized access to sensitive information or delete arbitrary files by supplying crafted input values to the FileUtil_GetFileInfo function. Directory traversal attacks exploit insufficient validation of user-supplied input, enabling attackers to navigate outside intended directories using sequences like ../ to access restricted file system locations.

Critical Impact

Attackers can read sensitive configuration files, access credentials, or delete critical system files without authentication, potentially compromising satellite ground station systems.

Affected Products

• OpenSatKit version 2.2.1
• OpenSatKit File Manager application (filemgr)
• Systems running the Core Flight System (cFS) with vulnerable OpenSatKit components

Discovery Timeline

• 2026-02-11 - CVE-2025-70084 published to NVD
• 2026-02-12 - Last updated in NVD database

Technical Details for CVE-2025-70084

Vulnerability Analysis

This directory traversal vulnerability (CWE-22) exists in the FileUtil_GetFileInfo function within OpenSatKit's file management module. The vulnerability stems from improper neutralization of special elements within file path parameters, allowing attackers to traverse directory boundaries and access files outside the intended directory scope.

OpenSatKit is a software suite designed for satellite development and ground station operations, built on NASA's Core Flight System (cFS). The file manager application provides file system operations for managing satellite data and configurations. When processing file path requests, the vulnerable function fails to properly sanitize path traversal sequences, allowing attackers to reference parent directories and access arbitrary files on the system.

The network-accessible nature of this vulnerability means that remote attackers can exploit it without requiring prior authentication or user interaction. Successful exploitation could expose sensitive satellite configuration data, telemetry information, cryptographic keys, or other mission-critical files.

Root Cause

The root cause of this vulnerability lies in the dir.c source file within the file manager application (cfs/apps/filemgr/fsw/src/dir.c). The FileUtil_GetFileInfo function does not adequately validate or sanitize user-supplied file paths before processing file operations. Specifically, the function fails to:

• Canonicalize file paths to resolve relative path components
• Reject path traversal sequences such as ../ or ..\
• Enforce path restrictions to contain file access within authorized directories
• Validate that resolved paths remain within expected directory boundaries

Attack Vector

This vulnerability is exploitable over the network without requiring authentication or user interaction. An attacker can craft malicious file path parameters containing directory traversal sequences and submit them to the FileUtil_GetFileInfo function.

The attack flow involves sending specially crafted path values that include traversal sequences like ../ to navigate up the directory tree. By chaining multiple traversal sequences, an attacker can escape the application's intended working directory and access files anywhere on the file system that the application process has permission to read.

For example, an attacker targeting satellite configuration files could craft a path that traverses from the file manager's working directory to system configuration directories, potentially exposing sensitive operational parameters, network configurations, or authentication credentials used by the ground station software.

Technical details regarding the exploitation mechanism can be found in the GitHub Gist Resource and the OpenSatKit Source Code File.

Detection Methods for CVE-2025-70084

Indicators of Compromise

• File access log entries showing path traversal sequences (../, ..%2f, %2e%2e/) in requested file paths
• Unexpected file read or delete operations targeting files outside the file manager's working directory
• Access attempts to sensitive system files such as /etc/passwd, configuration files, or credential stores
• Anomalous network traffic patterns to OpenSatKit file management endpoints containing encoded traversal characters

Detection Strategies

• Implement file integrity monitoring on critical system directories and configuration files
• Deploy network intrusion detection rules to identify path traversal patterns in requests to OpenSatKit services
• Enable verbose logging for the file manager application and monitor for path normalization failures
• Configure SentinelOne agents to detect and alert on suspicious file access patterns indicative of directory traversal exploitation

Monitoring Recommendations

• Monitor file system audit logs for access attempts to files outside designated OpenSatKit directories
• Establish baseline network behavior for OpenSatKit services and alert on deviations indicating exploitation attempts
• Implement real-time alerting for failed file access attempts that may indicate reconnaissance activity
• Review application logs regularly for evidence of path manipulation attempts

How to Mitigate CVE-2025-70084

Immediate Actions Required

• Restrict network access to OpenSatKit file management interfaces to trusted hosts only
• Implement additional input validation at network boundaries to filter path traversal sequences
• Review and limit file system permissions for the OpenSatKit application to minimize exposure
• Consider disabling or isolating the file manager component until a patch is available

Patch Information

As of the last NVD update on 2026-02-12, organizations should monitor the OpenSatKit GitHub Repository for security updates addressing this vulnerability. Review the OpenSatKit Release v2.2.1 page and subsequent releases for patches that address the directory traversal issue in the FileUtil_GetFileInfo function.

Workarounds

• Implement a web application firewall (WAF) or input filter to block requests containing path traversal sequences before they reach OpenSatKit
• Deploy network segmentation to isolate OpenSatKit systems from untrusted networks
• Configure file system access controls to enforce least-privilege principles for the OpenSatKit process
• Apply OS-level restrictions using mandatory access control frameworks (SELinux, AppArmor) to confine file access to authorized directories

# Example: Block path traversal at network level using iptables string matching
iptables -A INPUT -p tcp --dport 1234 -m string --string "../" --algo bm -j DROP
iptables -A INPUT -p tcp --dport 1234 -m string --string "..%2f" --algo bm -j DROP

# Example: Restrict file permissions for OpenSatKit working directory
chmod 750 /opt/opensatkit/data
chown opensatkit:opensatkit /opt/opensatkit/data