CVE-2026-53452 Ground Station: Unauthenticated out-of-containment file read via `sigmfplayback` `recordingPath`
Unauthenticated attackers can read arbitrary JSON files outside the intended directory via path traversal in the SDR playback feature.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-53452?
CVE-2026-53452 is a medium-severity path traversal vulnerability in sgoudelis ground-station, published on 19 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Ground Station is a browser-based suite for satellite tracking, SDR reception, hardware control, and telemetry decoding. Prior to version 0.4.13, the unauthenticated configure-sdr Socket.IO command accepts a recordingPath for the sigmf-playback SDR and backend/handlers/entities/sdr.py stores it without validation before backend/hardware/sigmfprobe.py opens the path without enforcing containment. An absolute path or parent-directory escape ending in .sigmf-meta is parsed as JSON and returned in reply["data"]["metadata"] by the get-sdr-parameters flow. Exploitation requires the metadata file to be readable JSON and to have a sibling .sigmf-data file, but it can disclose contents outside backend/data/recordings without authentication. This issue is fixed in version 0.4.13.
Which versions are affected by CVE-2026-53452?
How do I fix CVE-2026-53452?
No fix has been published for CVE-2026-53452 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-53452 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-53452 exists.
Sources
Also known as GHSA-g344-jqcx-cr7q.