Medium severity · published Feb 2, 2026
CVE-2026-25228
SignalK Server has Path Traversal leading to information disclosure
4.3
CVSS
0.4%
EPSS
No
On KEV
Description
Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.20.3, a path traversal vulnerability in SignalK Server's applicationData API allows authenticated users on Windows systems to read, write, and list arbitrary files and directories on the filesystem. The validateAppId() function blocks forward slashes (/) but not backslashes (\), which are treated as directory separators by path.join() on Windows. This enables attackers to escape the intended applicationData directory. This vulnerability is fixed in 2.20.3.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SI
signalk-server · SignalK
< 2.20.3 · source: vendor
SK
Signal K Server · Signalk
before 2.20.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-25228
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-25228
Patch
https://github.com/SignalK/signalk-server/commit/9bcf61c8fe2cb8a40998b913a02fb64dff9e86c7
Exploit
https://github.com/SignalK/signalk-server/security/advisories/GHSA-vrhw-v2hw-jffx
More from signalk-server
9.8
CVE-2026-118690
Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs
9.4
CVE-2026-33950
signalk-server: Privilege Escalation by Admin Role Injection via /enableSecurity
9.1
CVE-2025-68620
Signal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated Polling
8.8
CVE-2026-23515
RCE - Command Injection in Signal K set-system-time plugin
8.8
CVE-2025-69203
Signal K Server Vulnerable to Access Request Spoofing