Ground Station, a browser‑based satellite tracking and SDR system, allows unauthenticated users to send a configure‑sdr Socket.IO command that includes a recordingPath for the sigmf‑playback SDR. The backend stores this path without validation and later opens it without enforcing containment. An attacker can supply an absolute path or a parent‑directory escape that ends with a ".sigmf-meta" file; the backend parses that file as JSON and returns its contents in the get‑sdr‑parameters response. Because the path is not checked against the allowed recordings directory, the system may disclose arbitrary files on the host, provided that a sibling ".sigmf-data" file exists. This leads to a moderate confidentiality loss for files outside "backend/data/recordings".

The vulnerability affects the sgoudelis Ground Station suite on all releases prior to version 0.4.13. The fix is included in the 0.4.13 release, which can be obtained from the project releases or the commit that applies the change.

With a CVSS base score of 5.3, this issue is considered moderate. The EPSS score of less than 1% indicates a very low likelihood of exploitation, and the vulnerability is not listed in CISA KEV, suggesting a low overall threat but still relevant for exposure. The likely attack vector is remote: an unauthenticated user can use the browser interface or send a crafted Socket.IO message to trigger the vulnerable flow and receive the file contents. No high‑privilege or authentication requirements are needed, making the attack straightforward for anyone with network access to the service.