CVE-2026-53452 in Ground Station
Summary
by MITRE • 08/19/2026
Ground Station is a browser-based suite for satellite tracking, SDR reception, hardware control, and telemetry decoding. Prior to version 0.4.13, the unauthenticated configure-sdr Socket.IO command accepts a recordingPath for the sigmf-playback SDR and backend/handlers/entities/sdr.py stores it without validation before backend/hardware/sigmfprobe.py opens the path without enforcing containment. An absolute path or parent-directory escape ending in .sigmf-meta is parsed as JSON and returned in reply["data"]["metadata"] by the get-sdr-parameters flow. Exploitation requires the metadata file to be readable JSON and to have a sibling .sigmf-data file, but it can disclose contents outside backend/data/recordings without authentication. This issue is fixed in version 0.4.13.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
Ground Station is a browser-based software suite designed for satellite tracking, Software Defined Radio reception, hardware control, and telemetry decoding. The vulnerability identified within versions prior to 0.4.13 stems from an insecure handling of file paths in the Socket.IO communication layer. Specifically, the unauthenticated configure-sdr command allows clients to specify a recordingPath parameter intended for sigmf-playback SDR operations. This path is passed directly to backend/handlers/entities/sdr.py, which stores it without performing any validation or sanitization checks. The subsequent processing by backend/hardware/sigmfprobe.py opens this stored path to retrieve metadata but fails to enforce directory containment restrictions.
The core technical flaw constitutes an unrestricted file read vulnerability combined with a path traversal issue. Because the application does not validate that the provided recordingPath resides within the expected safe directory, typically backend/data/recordings/, attackers can supply absolute paths or use parent-directory escape sequences such as ../ to traverse outside of this restricted scope. The system attempts to parse any file ending in .sigmf-meta as JSON and returns its contents directly in the reply data structure under the key path data metadata via the get-sdr-parameters flow. This behavior effectively turns the application into a server-side request forgery-like vector for local files, allowing an attacker to read arbitrary files from the host system's filesystem provided they meet specific criteria.
Exploitation of this vulnerability requires that the target file be readable by the user running the Ground Station process and formatted as valid JSON. Additionally, there must exist a sibling .sigmf-data file in the same directory, although the primary impact is the disclosure of the metadata content itself. This lack of authentication for such sensitive configuration commands means that any remote actor with network access to the Ground Station interface can exploit this flaw without needing credentials. The operational impact includes the potential exposure of sensitive system information, internal configuration details, or other data stored in JSON format on the server's filesystem, which could aid further attacks against the infrastructure hosting the satellite tracking software.
This vulnerability aligns with CWE-20 Improper Input Validation and CWE-78 OS Command Injection principles related to path handling, specifically falling under the category of Path Traversal where input is not properly neutralized before being used in file operations. In terms of attack patterns, this behavior mirrors aspects of ATT&CK technique T1552 Unsecured Credentials or more broadly information gathering techniques that rely on local resource discovery through application logic flaws rather than direct system exploitation. The lack of authentication for administrative functions exacerbates the risk by removing a critical layer of defense-in-depth security controls.
The issue has been resolved in version 0.4.13 of Ground Station, which implements proper validation and containment checks for file paths before they are processed or opened by the backend components. Users operating older versions should upgrade immediately to mitigate the risk of unauthorized data disclosure. In addition to upgrading, administrators should ensure that the application runs with minimal privileges necessary for its operation, thereby limiting the scope of files an attacker could potentially read even if similar vulnerabilities were present in other parts of the system. Implementing strict input validation and enforcing directory containment policies are essential best practices for any software handling user-supplied file paths to prevent local information disclosure attacks.