CVE-2026-103244

Ground Station before version 0.4.13 contains a vulnerability in the unauthenticated save-waterfall-snapshot Socket.IO command. An attacker can control the snapshotName input, allowing file writes outside the data directory via path traversal. It is possible to write a YAML logging configuration file that, during service restart, executes arbitrary code (RCE) with service privileges.

A vulnerability in Ground Station (before 0.6.0) allows unauthenticated attackers to destroy or replace the entire SQLite database by sending a full_restore command to the Socket.IO server on port 7000. Lack of authentication and wildcard CORS policy enable remote exploitation.

Ground Station prior to version 0.4.13 contains a vulnerability where the unauthenticated configure-sdr Socket.IO command accepts a recordingPath for the sigmf-playback SDR and stores it without validation before opening the path without enforcing containment. An absolute path or parent-directory escape ending in .sigmf-meta is parsed as JSON and returned in reply["data"]["metadata"] by the get-sdr-parameters flow. Exploitation requires the metadata file to be readable JSON and to have a sibling .sigmf-data file, but it can disclose contents outside backend/data/recordings without authentication.

Ground Station prior to 0.6.0 contains an unauthenticated blind server-side request forgery vulnerability in the orbital-source configuration path. An unauthenticated Socket.IO client can connect on port 7000, persist an attacker-supplied URL in the database, and trigger an orbital sync, causing outbound HTTP requests to attacker-chosen destinations, including cloud metadata (169.254.169.254). HTTP status codes and error messages are emitted to clients, providing an oracle for interpreting internal-service responses.

Ground Station prior to 0.6.0 contains an unauthenticated denial-of-service vulnerability in the Socket.IO server's service_control event handler that allows any unauthenticated network peer to forcibly terminate the ground-station process by sending a single restart_service command. Attackers can connect to the Socket.IO server on port 7000 without credentials due to disabled authentication enforcement and a wildcard CORS policy, then emit the service_control event to terminate all active satellite-tracking sessions, SDR recording pipelines, demodulators, decoders, and rotator controllers, with repeated triggering possible in Docker deployments to create a persistent denial-of-service condition.