CVE-2026-53452: Ground Station: Unauthenticated out-of-containment file read via `sigmfplayback` `recordingPath`

Published Aug 19, 2026
·
Updated

Ground Station is a browser-based suite for satellite tracking, SDR reception, hardware control, and telemetry decoding. Prior to version 0.4.13, the unauthenticated configure-sdr Socket.IO command accepts a recordingPath for the sigmf-playback SDR and backend/handlers/entities/sdr.py stores it without validation before backend/hardware/sigmfprobe.py opens the path without enforcing containment. An absolute path or parent-directory escape ending in .sigmf-meta is parsed as JSON and returned in reply["data"]["metadata"] by the get-sdr-parameters flow. Exploitation requires the metadata file to be readable JSON and to have a sibling .sigmf-data file, but it can disclose contents outside backend/data/recordings without authentication. This issue is fixed in version 0.4.13.

Affected Software

1 affected component
Ground Station<0.4.13

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 0.4.13

Event History

Aug 19, 2026
CVE Published
via MITRE·02:44 PM
Data Sourced
via MITRE·02:44 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

Which deployments are exposed?

Ground Station versions before 0.4.13 are exposed if the Socket.IO interface can be reached by an attacker. No authentication is required for the affected configure-sdr command.

2

What does an attacker need to successfully read a file?

The target path must reference a readable JSON file ending in .sigmf-meta, and a sibling .sigmf-data file must exist. The disclosed JSON is returned through the get-sdr-parameters response metadata field.

3

Are recordings outside the intended recordings directory affected?

Yes. Absolute paths and parent-directory traversal paths can escape backend/data/recordings because the recordingPath is stored and later opened without containment enforcement.

4

What should be done if upgrading cannot happen immediately?

Restrict network access to the Ground Station Socket.IO service to trusted users and networks, since the vulnerable command is unauthenticated. Upgrade to version 0.4.13 when possible.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203