{"id":10586,"date":"2026-09-04T18:51:18","date_gmt":"2026-09-04T10:51:18","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-53451"},"modified":"2026-09-04T18:51:18","modified_gmt":"2026-09-04T10:51:18","slug":"cve-2026-53451","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-53451","title":{"rendered":"CVE-2026-53451 [CRITICAL] &#8211; Ground Station is a browser-based suite for satellite tracking, SDR reception, hardware co"},"content":{"rendered":"<p>Ground Station is a browser-based suite for satellite tracking, SDR reception, hardware control, and telemetry decoding. Prior to version 0.4.13, the unauthenticated save-waterfall-snapshot Socket.IO command passes attacker-controlled snapshotName input from backend\/handlers\/entities\/sdr.py to backend\/server\/snapshots.py, where os.path.join permits an absolute path or parent-directory traversal and writes attacker-controlled base64-decoded bytes outside backend\/data\/snapshots. An attacker can write a logging YAML file containing a logging.config.dictConfig callable factory, use the unauthenticated update-app-config operation to set log_config to that file, and invoke restart_service. During restart, backend\/common\/logger.py passes the YAML through resolve_log_config_path(), yaml.safe_load(), and logging.config.dictConfig(), which executes the factory with service privileges and can also cause a persistent crash loop. This issue is fixed in version 0.4.13.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Ground Station is a browser-based suite for satellite tracking, SDR reception, hardware control, and telemetry decoding. Prior to version 0.4.13, the unauthenticated save-waterfall-snapshot Socket.IO <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-10586","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/10586","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=10586"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=10586"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=10586"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}