GHSA-4xm8-rg9h-jhq2: Signal K resources API path traversal can disclose the JWT signing secret and enable remote code execution

October 30, 2026

Path traversal in the Signal K resources and applicationData APIs lets an unauthenticated or low-privileged user read, write and delete files outside the storage root. Reading /security.json discloses the JWT signing secret, enabling admin token forgery and remote code execution.

References

github.com/SignalK/signalk-server/commit/83689f040d7e90280dddc643f44f3e4ce348fbb1
github.com/SignalK/signalk-server/releases/tag/v2.34.0
github.com/SignalK/signalk-server/security/advisories/GHSA-4xm8-rg9h-jhq2
github.com/advisories/GHSA-4xm8-rg9h-jhq2

Code Behaviors & Features

Detect and mitigate GHSA-4xm8-rg9h-jhq2 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →