CVE-2026-25228: 
JavaScript vulnerability analysis and mitigation

CVE-2026-25228 is a path traversal vulnerability (CWE-22) in SignalK Server's applicationData API that allows authenticated users on Windows systems to read, write, and list arbitrary files and directories outside the intended application directory. It affects all versions of the signalk-server npm package up to and including 2.20.2, with version 2.20.3 containing the fix. The vulnerability was published on February 2, 2026, by researcher cchheang. It carries a CVSS v3.1 base score of 5.0 (Moderate) per the GitHub Advisory, though NVD scores it at 4.3 (Medium) (GitHub Advisory, SignalK Advisory).

The root cause is an incomplete input validation in the validateAppId() function within src/interfaces/applicationData.js, which checks for forward slashes (/) but not backslashes (\) (CWE-22). On Windows, Node.js's path.join() treats backslashes as directory separators, so a crafted appid parameter containing sequences like ..\..\..\ bypasses validation and causes the constructed path to escape the intended applicationData directory. The vulnerable path construction is: path.join(configPath, 'applicationData', 'users', deviceId, appid). A public PoC script (Python) is included in the advisory, demonstrating directory listing of the .signalk config directory and the user's home directory via crafted GET requests to /signalk/v1/applicationData/user/<traversal>. On Linux, the impact is limited to traversal of a single directory level (GitHub Advisory, SignalK Advisory).

Successful exploitation allows an authenticated attacker to read, list, and potentially write arbitrary files on the Windows filesystem hosting the SignalK Server, limited by the permissions of the server process. Sensitive data at risk includes the .signalk configuration directory (which may contain credentials, certificates, or API keys) and the user's home directory. Integrity impact depends on the user's write permissions, and there is no direct availability impact. The scope is marked as Changed in the GitHub Advisory's CVSS scoring, reflecting that the attacker can access resources outside the intended application boundary (GitHub Advisory).

A public PoC Python script is included in the official security advisory, making exploitation straightforward for any authenticated user. Authentication with a valid JWT token is required, which limits opportunistic exploitation but does not prevent insider threats or attackers who have obtained credentials. There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.011% (0.02% per GitHub Advisory), indicating a low probability of exploitation in the near term. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory, SignalK Advisory).

1. Obtain authentication credentials: Acquire a valid JWT token for the SignalK Server instance (e.g., via legitimate user account, phishing, or credential theft).
2. Identify target: Locate a SignalK Server instance running on Windows with version ≤ 2.20.2, accessible over the network (default port 3000).
3. Craft traversal request: Use a raw HTTP client (not requests or urllib, which normalize paths) to send a GET request with backslash-based traversal sequences in the appid parameter, e.g.:

   GET /signalk/v1/applicationData/user/..\..\..\  HTTP/1.1
   Authorization: Bearer <JWT_TOKEN>

4. Enumerate directories: Adjust the number of ..\ segments to traverse to target directories (3 levels reaches .signalk config dir; 4 levels reaches the user home directory).
5. Read sensitive files: Use the directory listing response to identify and retrieve sensitive files (e.g., configuration files, credentials, certificates) by appending specific filenames to the traversal path.
6. Optionally write files: If the server process has write permissions, craft PUT/POST requests with traversal paths to write or overwrite files on the filesystem (GitHub Advisory, SignalK Advisory).

• Network: HTTP GET requests to /signalk/v1/applicationData/user/ containing URL-encoded or literal backslash sequences (e.g., ..%5C..%5C or ..\..\ ) in the path; unusual access patterns to the applicationData API endpoint from authenticated users.
• Logs: SignalK server access logs showing requests to /signalk/v1/applicationData/user/ with appid values containing ..\ sequences; HTTP 200 responses to traversal paths that should not resolve within the applicationData directory.
• File System: Unexpected access timestamps on files in the .signalk configuration directory or user home directory that correlate with SignalK server process activity.
• Process: Node.js process (node.exe) performing file reads or directory listings outside the expected applicationData subdirectory, observable via process monitoring or file system auditing tools (GitHub Advisory).

Upgrade signalk-server to version 2.20.3 or later, which patches the vulnerability by adding backslash validation to validateAppId() and introducing a path.normalize()/path.resolve() boundary check to ensure resolved paths remain within the configuration directory (SignalK Commit). As a short-term workaround if upgrading is not immediately possible, restrict network access to the SignalK Server's applicationData API endpoint and limit authenticated user accounts to only those who require access. Running SignalK Server on Linux instead of Windows reduces the impact to single-directory traversal, though upgrading remains the recommended solution (GitHub Advisory).