Security readout for executives and security teams
Plain-English summary
An unauthenticated remote attacker can make vulnerable Ground Station servers write files outside the intended snapshot directory. By combining this with other unauthenticated configuration and restart functions, the attacker may run code with service privileges, alter data, steal information, or repeatedly crash the service.
Executive priority
Treat reachable pre-0.4.13 systems as an immediate remediation priority. Upgrade promptly and temporarily isolate them if patching cannot occur quickly. Because compromise could grant service-level execution and persistence through crash loops, affected systems should also receive focused configuration, filesystem, and log review.
Technical view
Before 0.4.13, save-waterfall-snapshot accepts an attacker-controlled filename and base64-decoded content without safely containing the destination path. Absolute paths or parent traversal enable arbitrary file writes. A crafted logging YAML can then be selected through update-app-config and loaded during restart_service; logging.config.dictConfig may invoke its configured factory, producing service-level code execution.
Likely exposure
Ground Station installations earlier than 0.4.13 are affected. Risk is greatest where the Socket.IO backend is reachable by untrusted networks because the documented chain requires no authentication, privileges, or user interaction. The supplied sources do not quantify internet exposure or identify default deployment boundaries.
Exploitation context
The CVSS score is 9.8, reflecting network access, low complexity, no authentication, and high confidentiality, integrity, and availability impact. The source bundle marks KEV false and provides no evidence of active exploitation. Public technical details may nevertheless reduce attacker research effort.
Researcher notes
The reported chain spans path traversal, arbitrary file write, unauthenticated configuration modification, and unsafe logging configuration behavior. The provided commit and advisory are the primary references for code-level review. No CPEs, observed attacks, proof-of-concept status, or deployment prevalence are supplied, so exposure must be established from each organization’s inventory and network controls.
Mitigation direction
- Upgrade Ground Station to version 0.4.13 or later.
- Until upgraded, restrict backend and Socket.IO access to trusted networks and authorized users.
- Review vendor advisory and release guidance before returning an exposed instance to service.
- Investigate unexpected configuration changes, snapshot files, logging YAML files, or repeated service restarts.
Validation and detection
- Confirm every Ground Station deployment reports version 0.4.13 or later.
- Verify snapshot destinations remain confined to the intended backend/data/snapshots directory.
- Check that log_config references only expected, administrator-controlled logging configuration files.
- Review configuration history and service logs for unauthorized updates, restarts, or crash loops.
- Inspect service-writable locations for unexpected files created during the suspected exposure window.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-22: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-73: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-94: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-53451 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9GitHub_MVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/sgoudelis/ground-station/security/advisories/GHSA-q35x-w3h6-36w8CVE reference, GitHub_M · x_refsource_CONFIRM
- https://github.com/sgoudelis/ground-station/commit/5649905f1021155933463a54a76030924adffb9dCVE reference, GitHub_M · x_refsource_MISC
- https://github.com/sgoudelis/ground-station/releases/tag/v0.4.13CVE reference, GitHub_M · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Limitation of a Pathname to a Restricted Directory
Improper Limitation of a Pathname to a Restricted Directory represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
External Control of File Name or Path
External Control of File Name or Path represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Improper Control of Generation of Code
Improper Control of Generation of Code represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.