CVE-2026-53451: Ground Station Path Traversal Vulnerability

CVE-2026-53451 Overview

CVE-2026-53451 is a critical path traversal vulnerability in Ground Station, a browser-based suite for satellite tracking, software-defined radio (SDR) reception, hardware control, and telemetry decoding. The flaw affects all versions prior to 0.4.13 and stems from insufficient path validation in the unauthenticated save-waterfall-snapshot Socket.IO handler. An unauthenticated remote attacker can chain the primitive with two additional unauthenticated operations to achieve arbitrary code execution with service privileges. The issue is tracked as CWE-22: Improper Limitation of a Pathname to a Restricted Directory and is fixed in version 0.4.13.

Critical Impact
Unauthenticated attackers reachable over the network can write arbitrary files outside backend/data/snapshots and pivot to remote code execution by injecting a malicious logging YAML that is passed to logging.config.dictConfig() during service restart.

Affected Products

Ground Station (sgoudelis/ground-station) versions prior to 0.4.13
Deployments exposing the Socket.IO backend to untrusted networks
Any Ground Station instance where the backend service runs with elevated privileges

Discovery Timeline

2026-08-19 - CVE-2026-53451 published to the National Vulnerability Database (NVD)
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-53451

Vulnerability Analysis

The vulnerability exists in the Ground Station backend and is exploitable in three unauthenticated stages. First, the save-waterfall-snapshot Socket.IO command in backend/handlers/entities/sdr.py accepts an attacker-controlled snapshotName value and forwards it to backend/server/snapshots.py. That module uses os.path.join without sanitization, so an absolute path or a ../ sequence bypasses the intended backend/data/snapshots sandbox. The handler then writes base64-decoded attacker bytes to the resulting location.

Second, the attacker uses the unauthenticated update-app-config operation to set the log_config field to the path of the file they just wrote. Third, the attacker calls restart_service. During restart, backend/common/logger.py passes the file through resolve_log_config_path(), yaml.safe_load(), and finally logging.config.dictConfig(). Because dictConfig supports a callable factory via () keys, arbitrary Python callables execute with service privileges. The same primitive can trigger a persistent crash loop.

Root Cause

The root cause is missing containment of user-supplied path components before file I/O. os.path.join treats any absolute path argument as replacing prior segments, and it does not normalize .. traversal. Ground Station never resolved the final path back to the intended snapshot root before writing.

Attack Vector

Exploitation requires only network access to the Socket.IO endpoint. No credentials, no user interaction, and no prior access to the host are needed. Combined with unauthenticated configuration mutation and service restart, a single attacker session yields code execution.

python

# Excerpt from the upstream fix introducing backend/common/pathguard.py
from __future__ import annotations

import os
from pathlib import Path
from typing import Iterable, List


def get_backend_root() -> Path:
    return Path(__file__).resolve().parent.parent


def get_recordings_root() -> Path:
    return (get_backend_root() / "data" / "recordings").resolve()


def get_snapshots_root() -> Path:
    return (get_backend_root() / "data" / "snapshots").resolve()


def _is_within(path: Path, root: Path) -> bool:
    try:
        path.relative_to(root)
        return True
    except ValueError:
        return False

Source: GitHub Commit 5649905

The patch introduces a dedicated pathguard module that resolves every candidate path and rejects any target outside the allowlisted roots via relative_to().

Detection Methods for CVE-2026-53451

Indicators of Compromise

Socket.IO save-waterfall-snapshot messages containing snapshotName values with ../, ..\\, or absolute paths such as /etc/, /tmp/, or C:\\.
Newly created files with .yaml or .yml extensions outside backend/data/snapshots, especially in directories owned by the Ground Station service account.
Unauthenticated update-app-config events that modify the log_config field, followed closely by restart_service invocations.
Ground Station service processes spawning unexpected child processes (shells, interpreters, or network utilities) shortly after restart.

Detection Strategies

Inspect Socket.IO application logs for the sequence: snapshot write → config update → service restart originating from the same client within a short interval.
Alert on any YAML file referenced by log_config that resides outside a curated allowlist directory.
Monitor logging.config.dictConfig behavior for callable factories referencing modules such as os, subprocess, or builtins.

Monitoring Recommendations

Enable audit logging on the Ground Station backend host for file creation events under backend/data/ and its parent directories.
Capture and retain Socket.IO message payloads long enough to reconstruct exploit chains during incident response.
Track version banners so vulnerable instances (< 0.4.13) are inventoried and prioritized.

How to Mitigate CVE-2026-53451

Immediate Actions Required

Upgrade Ground Station to version 0.4.13 or later without delay. The release notes are available on the GitHub Release v0.4.13 page.
Restrict network exposure of the Ground Station Socket.IO listener to trusted management networks only, using host firewall rules or a reverse proxy with client authentication.
Review file system contents under and adjacent to backend/data/snapshots for unexpected files, particularly YAML files that may have been planted.
Rotate any secrets accessible to the Ground Station service account if compromise is suspected.

Patch Information

The fix is committed in GitHub Commit 5649905 and shipped in release 0.4.13. The patch adds backend/common/pathguard.py, which resolves candidate paths against an allowlist of roots (data/snapshots, data/recordings, and optional directories supplied via GS_SIGMF_ALLOWED_DIRS) and rejects any path that is not contained within them. Full advisory details are published as GHSA-q35x-w3h6-36w8.

Workarounds

Block or reverse-proxy the save-waterfall-snapshot, update-app-config, and restart_service Socket.IO events until the upgrade is applied.
Run the Ground Station backend under a low-privilege service account so any successful exploitation is contained.
Mount backend/data/snapshots as a dedicated volume with restrictive permissions and, where feasible, a read-only parent directory.

bash

# Verify the installed version and upgrade to the patched release
pip show ground-station | grep -i version
git fetch --tags
git checkout v0.4.13
# Restart the service using your process manager, for example:
systemctl restart ground-station