CVE-2026-53451

Name of the Vulnerable Software and Affected Versions Ground Station versions prior to 0.4.13

Description An unauthenticated Socket.IO command save-waterfall-snapshot allows an attacker to control the snapshotName input. This input is processed by backend/handlers/entities/sdr.py and passed to backend/server/snapshots.py, where the use of os.path.join enables absolute path injection or parent-directory traversal. This allows the writing of base64-decoded bytes outside the intended backend/data/snapshots directory. An attacker can exploit this to create a malicious YAML logging file containing a logging.config.dictConfig callable factory. By using the unauthenticated update-app-config operation to set log config to this file and invoking restart service, the backend/common/logger.py component processes the file through resolve log config path(), yaml.safe load(), and logging.config.dictConfig(). This sequence executes the factory with service privileges and may result in a persistent crash loop.

Recommendations Update to version 0.4.13.