ground-station vulnerabilities

2 known vulnerabilities in ground-station from Sgoudelis. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  ground-station: Missing Authentication for Critical Functionality

  CVE-2026-103244Oct 1, 2026Sgoudelis

  ground-station versions before 0.8.0 contain an authentication bypass vulnerability in the setup.restore command that allows unauthenticated attackers to execute arbitrary SQL during first-run setup mode. Attackers can invoke setup.restore via Socket.IO to pla

• 9.8 Critical severity

  ground-station: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-53451Aug 19, 2026SgoudelisEPSS 1.08%

  Ground Station is a browser-based suite for satellite tracking, SDR reception, hardware control, and telemetry decoding. Prior to version 0.4.13, the unauthenticated save-waterfall-snapshot Socket.IO command passes attacker-controlled snapshotName input from b