CVE-2026-53451: Ground Station: Unauthenticated arbitrary file write (path traversal) in save-waterfall-snapshot leads to remote code execution
Ground Station is a browser-based suite for satellite tracking, SDR reception, hardware control, and telemetry decoding. Prior to version 0.4.13, the unauthenticated save-waterfall-snapshot Socket.IO command passes attacker-controlled snapshotName input from backend/handlers/entities/sdr.py to backend/server/snapshots.py, where os.path.join permits an absolute path or parent-directory traversal and writes attacker-controlled base64-decoded bytes outside backend/data/snapshots. An attacker can write a logging YAML file containing a logging.config.dictConfig callable factory, use the unauthenticated update-app-config operation to set logconfig to that file, and invoke restartservice. During restart, backend/common/logger.py passes the YAML through resolvelogconfigpath(), yaml.safeload(), and logging.config.dictConfig(), which executes the factory with service privileges and can also cause a persistent crash loop. This issue is fixed in version 0.4.13.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ground Stationto a version that resolves this vulnerability.Fixed in 0.4.13 - Compensating control
Until upgraded, block unauthenticated access to the save-waterfall-snapshot Socket.IO command and any related unauthenticated update-app-config operation (and restart_service trigger) at the network/application layer so attacker-controlled path/snapshotName and log_config cannot be set.
Event History
Frequently Asked Questions
Which deployments are exposed?
Ground Station versions before 0.4.13 are affected. The vulnerable Socket.IO command and the configuration update and restart operations are described as unauthenticated, so no valid account or user interaction is required.
What does an attacker need to do to achieve code execution?
An attacker must send a save-waterfall-snapshot request with a crafted snapshotName that escapes the snapshots directory and writes attacker-controlled base64-decoded content. They can then configure log_config to reference a malicious logging YAML file and restart the service, causing logging.config.dictConfig to execute the YAML-defined callable factory with service privileges.
What is the impact if exploitation succeeds?
Successful exploitation can result in remote code execution with the Ground Station service's privileges. A malicious logging configuration can also produce a persistent crash loop during service restart.
What should be done if an immediate upgrade is not possible?
The provided data identifies the unauthenticated save-waterfall-snapshot, update-app-config, and restart_service operations as the attack chain. Restricting unauthenticated network access to the Ground Station service until it can be upgraded reduces exposure.
How can I determine whether an instance is affected?
Check the installed Ground Station version: versions earlier than 0.4.13 are affected, while version 0.4.13 contains the fix.