Ground Station, a browser‑based satellite tracking and SDR system, allows unauthenticated users to send a configure‑sdr Socket.IO command that includes a recordingPath for the sigmf‑playback SDR. The backend stores this path without validation and later opens it without enforcing containment. An attacker can supply an absolute path or a parent‑directory escape that ends in a ".sigmf-meta" file; the backend parses that file as JSON and returns its contents in the get‑sdr‑parameters response. Because the path is not checked against the allowed recordings directory, the system may disclose arbitrary files on the host, provided that a sibling ".sigmf-data" file exists. This results in a moderate confidentiality loss for files outside "backend/data/recordings".

The vulnerability affects the sgoudelis Ground Station suite on all releases prior to version 0.4.13. The fix is included in the 0.4.13 release, which can be obtained from the project releases or the commit that applies the change.

With a CVSS base score of 5.3, this issue is considered moderate. EPSS data is not available and the vulnerability is not listed in CISA KEV, suggesting a lower but still non‑negligible risk of exploitation. The likely attack vector is remote: an unauthenticated user can use the browser interface or send a crafted Socket.IO message to trigger the vulnerable flow and receive the file contents. No high‑privilege or authentication requirements are needed, making the attack straightforward for anyone with network access to the service.