CVE-2025-66398

Critical

Published: 01/01/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

Signal K Server before version 2.19.0 allows an unauthenticated attacker to pollute the internal state (restoreFilePath) via the /skServer/validateBackup endpoint, enabling hijacking of the administrator's Restore functionality to overwrite critical configuration files, leading to account takeover and RCE.

Risk Assessment

An attacker can take over the server by modifying configuration and executing malicious code.

Recommendation

Update Signal K Server to version 2.19.0 or later.

Original NVD description (English source)

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal state (`restoreFilePath`) of the server via the `/skServer/validateBackup` endpoint. This allows the attacker to hijack the administrator's "Restore" functionality to overwrite critical server configuration files (e.g., `security.json`, `package.json`), leading to account takeover and Remote Code Execution (RCE). Version 2.19.0 patches this vulnerability.