Executive brief
SignalK Server is a marine navigation data aggregation platform used on vessels to centralize sensor and instrument data. On Windows systems, an authenticated user can read, write, and list arbitrary files outside the intended application data directory by exploiting a path traversal flaw in the file API. This allows exposure of sensitive configuration files, credentials, and other system data stored on the server.
Technical details
A path traversal vulnerability exists in SignalK Server's applicationData API handler, specifically in the validateAppId() function. The function validates the appid parameter but only blocks forward slashes (/), not backslashes (\), which are treated as directory separators on Windows. Attackers who have valid authentication credentials can craft API requests using backslash-based traversal sequences (e.g., `..\..\..\`) to escape the intended applicationData directory and access arbitrary files. The vulnerability requires authentication and is platform-specific to Windows; Linux is unaffected. The fix involves validating both slash types and using path normalization to ensure resolved paths remain within the intended directory.
Affected products
- SignalK SignalK Server <=2.20.2
Timeline
- 2026-02-02: disclosed
- 2026-02-03: patched: Fixed in version 2.20.3