5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25228

CVE-2026-25228: SignalK Server has Path Traversal leading to information disclosure

Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.20.3, a path traversal vulnerability in SignalK Server's applicationData API allows authenticated users on Windows systems to read, write, and list arbitrary files and directories on the filesystem. The validateAppId() function blocks forward slashes (/) but not backslashes (), which are treated as directory separators by path.join() on Windows. This enables attackers to escape the intended applicationData directory. This vulnerability is fixed in 2.20.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25228

CVE-2026-25228:

5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
signalk-server	npm	<= 2.20.2	2.20.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a path traversal in the applicationData API, specific to Windows environments. The root cause lies in two functions within src/interfaces/applicationData.js. First, the validateAppId function failed to block backslashes (\) in the appid parameter, only checking for forward slashes (/). Since Windows treats both as path separators, an attacker could craft an appid with ..\ sequences to navigate up the directory structure. Second, the pathForApplicationData function used the tainted appid directly in a path.join() operation. This operation resolved the traversal sequences, creating a path pointing outside the intended storage directory. The patch addresses this by adding a backslash check in validateAppId and by normalizing the path in pathForApplicationData and verifying that the resolved path is still within the expected base directory, preventing the traversal.

Vulnerable functions

validateAppId

src/interfaces/applicationData.js

This function is responsible for validating the `appid` parameter used in file paths. The vulnerability exists because the function only checks for forward slashes (`/`) and not backslashes (`\`). On Windows, backslashes are also path separators, so an attacker could use `..\` sequences to traverse the file system, bypassing this validation.

pathForApplicationData

src/interfaces/applicationData.js

This function constructs the final file path for application data using the `appid` parameter. It is vulnerable because it uses `path.join` with the unsanitized `appid`. On Windows, this allows path traversal sequences (e.g., `..\..\`) to be resolved, enabling an attacker to access paths outside of the intended `applicationData` directory.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.