CVE-2026-53452 Ground Station: Unauthenticated out-of-containment file read via `sigmfplayback` `recordingPath`

Ground Station is a browser-based suite for satellite tracking, SDR reception, hardware control, and telemetry decoding. Prior to version 0.4.13, the unauthenticated configure-sdr Socket.IO command accepts a recordingPath for the sigmf-playback SDR and backend/handlers/entities/sdr.py stores it...

CVE-2026-53452

Ground Station (a browser-based satellite tracking and SDR suite) prior to version 0.4.13 is vulnerable to an unauthenticated out-of-containment file read . The configure-sdr Socket.IO command accepts a recordingPath parameter that is stored without validation in backend/handlers/entities/sdr.py ...