Signal K Server's applicationData API contains a path traversal flaw that allows authenticated users on Windows systems to read, write, and list arbitrary files and directories. The validateAppId() function blocks forward slashes but does not remove backslashes, which on Windows are interpreted as directory separators by path.join(), enabling an attacker to escape the intended applicationData directory. This flaw can lead to accidental or intentional disclosure of sensitive data and unauthorized modification of files, undermining confidentiality and integrity of the vessel’s data environment.

SignalK Server versions prior to 2.20.3 on Windows operating systems are affected. The vulnerability is fixed in version 2.20.3 and later, so upgrading to at least that release removes the risk.

The CVSS score of 5 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation. The flaw requires the attacker to be an authenticated user on a Windows system, but once those conditions are met, the attacker can traverse directories and access or modify any files the process can read or write, potentially compromising critical operational data.