CVE-2026-53452: Ground Station: Unauthenticated out-of-containment file read via `sigmfplayback` `recordingPath`
Ground Station is a browser-based suite for satellite tracking, SDR reception, hardware control, and telemetry decoding. Prior to version 0.4.13, the unauthenticated configure-sdr Socket.IO command accepts a recordingPath for the sigmf-playback SDR and backend/handlers/entities/sdr.py stores it without validation before backend/hardware/sigmfprobe.py opens the path without enforcing containment. An absolute path or parent-directory escape ending in .sigmf-meta is parsed as JSON and returned in reply["data"]["metadata"] by the get-sdr-parameters flow. Exploitation requires the metadata file to be readable JSON and to have a sibling .sigmf-data file, but it can disclose contents outside backend/data/recordings without authentication. This issue is fixed in version 0.4.13.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.4.13
Event History
Frequently Asked Questions
Which deployments are exposed?
Ground Station versions before 0.4.13 are exposed if the Socket.IO interface can be reached by an attacker. No authentication is required for the affected configure-sdr command.
What does an attacker need to successfully read a file?
The target path must reference a readable JSON file ending in .sigmf-meta, and a sibling .sigmf-data file must exist. The disclosed JSON is returned through the get-sdr-parameters response metadata field.
Are recordings outside the intended recordings directory affected?
Yes. Absolute paths and parent-directory traversal paths can escape backend/data/recordings because the recordingPath is stored and later opened without containment enforcement.
What should be done if upgrading cannot happen immediately?
Restrict network access to the Ground Station Socket.IO service to trusted users and networks, since the vulnerable command is unauthenticated. Upgrade to version 0.4.13 when possible.