EUVD-2026-267393

fkie_cve-2026-25228

Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.20.3, a path traversal vulnerability in SignalK Server's applicationData API allows authenticated users on Windows systems to read, write, and list arbitrary files and directories on the filesystem. The validateAppId() function blocks forward slashes (/) but not backslashes (\), which are treated as directory separators by path.join() on Windows. This enables attackers to escape the intended applicationData directory. This vulnerability is fixed in 2.20.3.

GHSA-vrhw-v2hw-jffx — SignalK Server has Path Traversal leading to information disclosure

Affected: npm: signalk-server

### Summary A Path Traversal vulnerability in SignalK Server's `applicationData` API allows authenticated users on Windows systems to read, write, and list arbitrary files and directories on the filesystem. The `validateAppId()` function blocks forward slashes (`/`) but not backslashes (`\`), which are treated as directory separators by `path.join()` on Windows. This enables attackers to escape the intended `applicationData` directory.

### Details **Platform**: Windows (Linux only allows traversal up a single directory) **Authentication Required**: Yes (ability to write depends on user's permission)

The vulnerability exists in the `validateAppId()` function within the applicationData API handler. This function validates the `appid` parameter but only checks for forward slashes:

```javascript // Simplified vulnerable code pattern function validateAppId(appid) { if (appid.includes('/') || appid.length >= 30) { return false; } return true; }

// Later used in path construction const dataPath = path.join(configPath, 'applicationData', 'users', deviceId, appid); ```

**Root Cause:** - The validation only blocks `/` characters - On Windows, `path.join()` uses the platform's native path separator - Windows treats both `/` and `\` as valid directory separators - Backslash-based traversal sequences like `..\..\..` pass validation - When `path.join()` processes these on Windows, each `..` traverses up one directory level

### PoC ```python #!/usr/bin/env python3

import a…

Most recent entries from all

EUVD-2026-267393

fkie_cve-2026-25228

GHSA-vrhw-v2hw-jffx — SignalK Server has Path Traversal leading to information disclosure