CVE-2025-66398

Signal K Server before 2.19.0 lets an unauthenticated attacker overwrite the server's internal restoreFilePath state through the /skServer/validateBackup endpoint. When an administrator subsequently uses the server's 'Restore' function, the attacker-controlled path is used, allowing critical configuration files such as security.json and package.json to be overwritten. By tampering with these files, the attacker can take over the administrator account and achieve remote code execution on the server host. All Signal K Server deployments running a version earlier than 2.19.0 are affected, especially instances reachable from untrusted networks. No in-the-wild exploitation has been reported yet, but public proof-of-concept material exists and EPSS estimates a roughly 20% probability of exploitation within 30 days (97th percentile).

What to do: Upgrade to Signal K Server 2.19.0 or later. Where immediate upgrade is not possible, restrict untrusted network access to the /skServer/validateBackup and restore endpoints (firewall or reverse-proxy rules) and avoid triggering the Restore function until patched, then verify that security.json has not been tampered with. Administrators of internet-exposed instances should prioritize the update given the elevated 20% EPSS exploitation probability.