CVE-2026-123807

Name of the Vulnerable Software and Affected Versions Signal K Server versions 2.0.0 through 2.33.9 @signalk/resources-provider versions 1.0.0 through 1.5.2

Description Signal K Server is a server application that runs on a central hub in a boat. A path traversal issue exists in the v2 REST route 'GET /signalk/v2/api/resources/:resourceType/:resourceId' where an unsafe resourceId can escape the intended resource directory. The route passes the resourceId through src/api/resources/index.ts to the getResource() function in packages/resources-provider-plugin/src/filestorage.ts without adequate path containment, allowing arbitrary JSON files reachable by the server to be read. Additionally, related PUT and DELETE operations can write or delete files outside the storage root. Deployments with allow readonly enabled permit anonymous reads, while others require a readonly user token. Reading the security.json file exposes the HS256 JWT signing secret and password hashes, which can be used to forge an administrator token. With administrative access to the 'POST /skServer/providers' endpoint, an attacker can create an Execute provider to run commands with server process privileges and persist the configuration across restarts.

Recommendations Update Signal K Server to version 2.34.0. Update @signalk/resources-provider to version 1.5.3.