CVE-2025-66398

CRITICAL

Signal K Server <2.19.0 - RCE

Title source: llm

Description

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal state (`restoreFilePath`) of the server via the `/skServer/validateBackup` endpoint. This allows the attacker to hijack the administrator's "Restore" functionality to overwrite critical server configuration files (e.g., `security.json`, `package.json`), leading to account takeover and Remote Code Execution (RCE). Version 2.19.0 patches this vulnerability.

Exploits (2)

nomisec WORKING POC 1 stars

by joshuavanderpoll · poc

https://github.com/joshuavanderpoll/cve-2025-66398

View Code ZIP pw:eip

nomisec WORKING POC

by showy-headteacher114 · poc

https://github.com/showy-headteacher114/cve-2025-66398

View Code ZIP pw:eip

References (2)

[Release Notes] https://github.com/SignalK/signalk-server/releases/tag/v2.19.0

[Exploit, Vendor Advisory] https://github.com/SignalK/signalk-server/security/advisories/GHSA-w3x5-7c4c-66p9

Scores

CVSS v3 9.6

EPSS 0.0012

EPSS Percentile 30.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Details

CWE

CWE-78 CWE-913

Status published

Products (2)

npm/signalk-server 0 - 2.19.0npm

signalk/signal_k_server < 2.19.0

Published Jan 01, 2026

Tracked Since Feb 18, 2026