Vulnerability · Published Feb 2, 2026 · Assigned by GitHub_M
CVE-2026-25228SignalK Server has Path Traversal leading to information disclosure
Medium 5.0
In plain English
A medium-severity path traversal in signalk-server from SignalK. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.20.3, a path traversal vulnerability in SignalK Server's applicationData API allows authenticated users on Windows systems to read, write, and list arbitrary files and directories on the filesystem. The validateAppId() function blocks forward slashes (/) but not backslashes (\), which are treated as directory separators by path.join() on Windows. This enables attackers to escape the intended applicationData directory. This vulnerability is fixed in 2.20.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | signalk-server | 2.20.3 | GHSA-vrhw-v2hw-jffx |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SignalK | signalk-server | < 2.20.3 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N