CVE-2026-123807

The Signal K Server (v2.0.0–2.33.9) and @signalk/resources-provider (v1.0.0–1.5.2) are vulnerable to a path traversal flaw in the v2 REST resources API. The GET /signalk/v2/api/resources/:resourceType/:resourceId route fails to validate the resourceId parameter, allowing attackers to escape the i...

CVE-2026-123807: SignalK, @signalk: Signal K Server is a server application that runs on a central hub in a boat

Signal K Server is a server application that runs on a central hub in a boat. From 2.0.0 until 2.34.0 for Signal K Server and from 1.0.0 until 1.5.3 for @signalk/resources-provider, the v2 REST route GET /signalk/v2/api/resources/:resourceType/:resourceId accepts an unsafe resourceId that can...