https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 22:35:06 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-264911 EUVD-2026-264911 https://cve.radiocsirt.org/vuln/euvd-2026-264911 https://cve.radiocsirt.org/vuln/fkie_cve-2025-66398 <p>Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal state (`restoreFilePath`) of the server via the `/skServer/validateBackup` endpoint. This allows the attacker to hijack the administrator&#39;s &#34;Restore&#34; functionality to overwrite critical server configuration files (e.g., `security.json`, `package.json`), leading to account takeover and Remote Code Execution (RCE). Version 2.19.0 patches this vulnerability.</p> <p>Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal state (`restoreFilePath`) of the server via the `/skServer/validateBackup` endpoint. This allows the attacker to hijack the administrator&#39;s &#34;Restore&#34; functionality to overwrite critical server configuration files (e.g., `security.json`, `package.json`), leading to account takeover and Remote Code Execution (RCE). Version 2.19.0 patches this vulnerability.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-66398 https://cve.radiocsirt.org/vuln/ghsa-w3x5-7c4c-66p9 <p><strong>Affected:</strong> npm: signalk-server</p> <p>### Summary An unauthenticated attacker can pollute the internal state (`restoreFilePath`) of the server via the `/skServer/validateBackup` endpoint. This allows the attacker to hijack the administrator&#39;s &#34;Restore&#34; functionality to overwrite critical server configuration files (e.g., `security.json`, `package.json`), leading to account takeover and Remote Code Execution (RCE).</p> <p>### Details The vulnerability is caused by the use of a module-level global variable `restoreFilePath` in `src/serverroutes.ts`, which is shared across all requests.</p> <p>**Vulnerable Code Analysis:** 1. **Global State**: `restoreFilePath` is defined at the top level of the module. ```typescript // src/serverroutes.ts let restoreFilePath: string ``` 2. **Unauthenticated State Pollution**: The `/skServer/validateBackup` endpoint updates this variable. Crucially, this endpoint **lacks authentication middleware**, allowing any user to access it. ```typescript app.post(`${SERVERROUTESPREFIX}/validateBackup`, (req, res) =&gt; { // ... handles file upload ... restoreFilePath = fs.mkdtempSync(...) // Attacker controls this path }) ``` 3. **Restore Hijacking**: The `/skServer/restore` endpoint uses the polluted `restoreFilePath` to perform the restoration. ```typescript app.post(`${SERVERROUTESPREFIX}/restore`, (req, res) =&gt; { // ... const unzipStream = unzipper.Extract({ path: restoreFilePath }) // Uses polluted path // ... }) ```</p> <p>**E…</p> <p><strong>Affected:</strong> npm: signalk-server</p> <p>### Summary An unauthenticated attacker can pollute the internal state (`restoreFilePath`) of the server via the `/skServer/validateBackup` endpoint. This allows the attacker to hijack the administrator&#39;s &#34;Restore&#34; functionality to overwrite critical server configuration files (e.g., `security.json`, `package.json`), leading to account takeover and Remote Code Execution (RCE).</p> <p>### Details The vulnerability is caused by the use of a module-level global variable `restoreFilePath` in `src/serverroutes.ts`, which is shared across all requests.</p> <p>**Vulnerable Code Analysis:** 1. **Global State**: `restoreFilePath` is defined at the top level of the module. ```typescript // src/serverroutes.ts let restoreFilePath: string ``` 2. **Unauthenticated State Pollution**: The `/skServer/validateBackup` endpoint updates this variable. Crucially, this endpoint **lacks authentication middleware**, allowing any user to access it. ```typescript app.post(`${SERVERROUTESPREFIX}/validateBackup`, (req, res) =&gt; { // ... handles file upload ... restoreFilePath = fs.mkdtempSync(...) // Attacker controls this path }) ``` 3. **Restore Hijacking**: The `/skServer/restore` endpoint uses the polluted `restoreFilePath` to perform the restoration. ```typescript app.post(`${SERVERROUTESPREFIX}/restore`, (req, res) =&gt; { // ... const unzipStream = unzipper.Extract({ path: restoreFilePath }) // Uses polluted path // ... }) ```</p> <p>**E…</p> https://cve.radiocsirt.org/vuln/ghsa-w3x5-7c4c-66p9