Loading story…
A critical vulnerability tracked as CVE-2026-53451 exposed Ground Station to unauthenticated arbitrary file write through path traversal in the save-waterfall-snapshot Socket.IO command. In versions prior to 0.4.13, attacker-controlled snapshotName input could escape the intended snapshots directory and write base64-decoded content to arbitrary filesystem paths. The issue affected the browser-based platform used for satellite tracking, SDR reception, hardware control, and telemetry decoding, and carried a CVSS 9.8 rating because it was remotely exploitable without privileges or user interaction.
The flaw could be chained with the unauthenticated update-app-config operation and restart_service to load a malicious logging YAML configuration, allowing logging.config.dictConfig to execute attacker-controlled code with service privileges and potentially force the application into a persistent crash loop. The vendor addressed the issue in v0.4.13 and in commit 5649905, which added a pathguard module, blocked absolute paths and traversal sequences in snapshot names, and enforced trusted-root validation for snapshot handling and SigMF playback files including .sigmf-meta and .sigmf-data. Security tests were also added to ensure traversal attempts are rejected and file access remains confined to approved directories.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
On 2026-08-19, CVE-2026-53451 was published describing a critical unauthenticated path traversal and arbitrary file write vulnerability in Ground Station versions prior to 0.4.13. The advisory stated the flaw could be chained into remote code execution via malicious logging configuration and noted that version 0.4.13 fixes the issue.
On 2026-05-30, Ground Station Docker image version 0.4.13 was released for production, and the release notes explicitly included the security fix preventing path traversal in snapshots and SigMF playback. The release published updated container images for amd64 and arm64.
On 2026-05-30, sgoudelis committed a security fix in the ground-station repository to prevent path traversal in snapshot saving and SigMF playback by adding path validation and allowed-root enforcement. The fix is identified by commit 5649905 and is associated with version tag v0.7.19.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities were disclosed affecting exposed application and device management surfaces, including a flaw that can give attackers **root access** and another that enables **arbitrary file write** through path traversal. **CVE-2026-3587** describes an unauthenticated remote attack path in a hidden CLI function that lets an attacker escape a restricted prompt and gain root access to the underlying Linux operating system, potentially leading to full device compromise. The issue was mapped to `CWE-912` and assigned a `CVSS v3.1` score vector of `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`, with CERT VDE publishing advisory `VDE-2026-020`. A separate vulnerability, **CVE-2026-5027**, affects Langflow's `POST /api/v2/files` endpoint, where improper sanitization of the multipart `filename` parameter allows path traversal using `../` sequences. An authenticated attacker can exploit the bug to write files to arbitrary filesystem locations, creating a route to compromise confidentiality, integrity, and availability. The flaw was classified as `CWE-22`, carries the `CVSS v3.1` vector `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`, and is referenced in Tenable advisory `TRA-2026-26`.
Jun 29, 2026
A security researcher publicly disclosed **20+ vulnerabilities** in the **International Data Casting (IDC) SFX2100 satellite receiver**, a device reported as deployed across **U.S. Department of Defense**, **European Space Agency**, and other critical infrastructure environments, after the vendor allegedly failed to respond to repeated disclosure attempts over several months. Reported issues span common embedded-device failure modes including **hardcoded credentials**, **unauthenticated remote code execution**, **OS command injection**, **path traversal**, and overly permissive filesystem configurations, with CVEs assigned across **CVE-2026-28769 through CVE-2026-29128**. One highlighted high-impact issue, **CVE-2026-28775**, reportedly enables **unauthenticated command execution as `root`** by abusing **SNMP** management functionality combined with a default read-write community string of `private`. Additional detail on the credential exposure risk is captured in **CVE-2026-29128**, which describes **world-readable routing daemon configuration files** (e.g., `zebra.conf`, `bgpd.conf`, `ospfd.conf`, `ripd.conf`) that are root-owned but readable by all users and contain **plaintext/hardcoded passwords** (including privileged “enable” credentials). This condition can enable credential reuse and lateral movement, potentially helping an attacker establish or deepen access within networks where the SFX2100 is deployed, and it compounds other reported weaknesses such as undocumented default accounts (e.g., `admin`, `monitor`, `user`, `xd`) allegedly sharing a weak password (`12345`).
Jun 29, 2026
Splunk issued urgent fixes for **CVE-2026-20253**, a critical `CVSS 9.8` vulnerability in **Splunk Enterprise** that allows unauthenticated arbitrary file creation and truncation through a PostgreSQL sidecar service endpoint missing authentication controls. The flaw affects supported Splunk Enterprise releases prior to **10.4.0**, **10.2.4**, **10.0.7**, **9.4.12**, and **9.3.13** depending on branch, and Splunk said **Splunk Cloud is not affected** because it does not use Postgres sidecars. Splunk and national cyber authorities urged administrators to apply updates immediately, noting that no vendor detections or workarounds were initially available for the core issue. Public technical analysis from watchTowr Labs showed the bug can be reached through Splunk Web on port `8000`, which proxies requests to localhost-only PostgreSQL recovery endpoints, enabling attackers to abuse `/v1/postgres/recovery/backup` and `/restore` for filesystem access. Researchers demonstrated a full pre-auth exploitation chain that used path traversal, PostgreSQL connection-string injection, local `.pgpass` credentials, and PostgreSQL large-object export to gain arbitrary file write as the `splunk` user, then overwrite a Splunk Python script to achieve remote code execution. Splunk also disclosed additional Enterprise flaws including **CVE-2026-20251** (`CVSS 8.8`) in the Splunk Secure Gateway app due to unsafe `jsonpickle` deserialization, plus stored XSS and SSRF issues, prompting guidance to patch quickly, restrict dashboard creation and web exposure, and disable or remove vulnerable components where immediate upgrades are not possible.
Jul 23, 2026