{"id":"EUVD-2025-206140","enisaUuid":"1897b57a-d23f-3d6e-ab9b-34bcad8550bc","description":"Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal state (`restoreFilePath`) of the server via the `/skServer/validateBackup` endpoint. This allows the attacker to hijack the administrator\u0027s \"Restore\" functionality to overwrite critical server configuration files (e.g., `security.json`, `package.json`), leading to account takeover and Remote Code Execution (RCE). Version 2.19.0 patches this vulnerability.","datePublished":"Jan 1, 2026, 6:00:38 PM","dateUpdated":"Jan 5, 2026, 9:00:41 PM","baseScore":9.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","references":"https://github.com/SignalK/signalk-server/security/advisories/GHSA-w3x5-7c4c-66p9\nhttps://github.com/SignalK/signalk-server/releases/tag/v2.19.0\n","aliases":"CVE-2025-66398\nGHSA-w3x5-7c4c-66p9\n","assigner":"GitHub_M","epss":19.85,"enisaIdProduct":[{"id":"695f82fb-b6a4-31b2-b522-1744febf5a60","product":{"name":"signalk-server","vendor":{"name":"SignalK"}},"product_version":"\u003c 2.19.0"}],"enisaIdVendor":[{"id":"673a9467-78a8-3d72-b9dc-eabc3a095442","vendor":{"name":"SignalK"}}],"enisaIdVulnerability":[{"id":"8d56de46-6f23-357d-86b2-2323878ed183","vulnerability":{"id":"CVE-2025-66398","description":"Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal state (`restoreFilePath`) of the server via the `/skServer/validateBackup` endpoint. This allows the attacker to hijack the administrator\u0027s \"Restore\" functionality to overwrite critical server configuration files (e.g., `security.json`, `package.json`), leading to account takeover and Remote Code Execution (RCE). Version 2.19.0 patches this vulnerability.","datePublished":"Jan 1, 2026, 6:00:38 PM","dateUpdated":"Jan 5, 2026, 9:00:41 PM","status":"PUBLISHED","baseScore":9.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","references":"https://github.com/SignalK/signalk-server/security/advisories/GHSA-w3x5-7c4c-66p9\nhttps://github.com/SignalK/signalk-server/releases/tag/v2.19.0\n","enisa_id":"EUVD-2025-206140\n","assigner":"GitHub_M","epss":19.85,"dataProcessed":"Nov 9, 2026, 7:20:17 AM","vulnerabilityProduct":[{"id":"12aa248d-3dc1-38bc-8f7b-9a4a8f828b92","product":{"name":"signalk-server","vendor":{"name":"SignalK"}},"product_version":"\u003c 2.19.0"}],"vulnerabilityVendor":[{"id":"22b111ae-2b45-3c64-941b-043aa7a1bfbe","vendor":{"name":"SignalK"}}]}},{"id":"c5008abe-6a5d-3560-bf77-f9db8e90bdc7","vulnerability":{"id":"GHSA-w3x5-7c4c-66p9","description":"Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)","datePublished":"Jan 2, 2026, 3:11:49 PM","dateUpdated":"Jan 2, 2026, 3:11:50 PM","baseScore":0.0,"references":"https://github.com/SignalK/signalk-server/security/advisories/GHSA-w3x5-7c4c-66p9\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-66398\nhttps://github.com/SignalK/signalk-server/commit/5c211eaf33f0ccadbaed6720264780d92afbd7f8\nhttps://github.com/SignalK/signalk-server\nhttps://github.com/SignalK/signalk-server/releases/tag/v2.19.0\n","enisa_id":"EUVD-2025-206140\n","aliases":"CVE-2025-66398\nGHSA-w3x5-7c4c-66p9\n","epss":0.0,"dataProcessed":"Nov 8, 2026, 1:54:33 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}