SignalK Server has Path Traversal leading to information disclosure

Description

A Path Traversal vulnerability in SignalK Server’s applicationData API allows authenticated users on Windows systems to read, write, and list arbitrary files and directories on the filesystem. The validateAppId() function blocks forward slashes (/) but not backslashes (\), which are treated as directory separators by path.join() on Windows.

Recommendation

Update the signalk-server package to the latest compatible version. Followings are version details:

• Affected version(s): <= 2.20.2
• Patched version(s): 2.20.3

References

• GHSA-vrhw-v2hw-jffx
• CVE-2026-25228
• CWE-22
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• liquidjs has a path traversal fallback vulnerability - CVE-2026-30952
• Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE) - CVE-2025-66398
• Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpoints - CVE-2025-68273
• Rollup 4 has Arbitrary File Write via Path Traversal - CVE-2026-27606

Tags:

npm

signalk-server