Signal K: 558 Title Matches, 1,085 Body Matches, and a Path Traversal With a Visibility Condition
Signal K is an open data standard and server used in marine and vessel data networks. A ZoomEye count-only observation on November 7, 2026 returned zero for app="Signal K", 558 for title="Signal K", and 1,085 for http.body="Signal K".
The advisory
GHSA-4xm8-rg9h-jhq2 describes a path traversal in the Signal K v2 resources and applicationData APIs. The resource identifier was passed to FileStore.getResource() without validation, allowing encoded traversal outside the storage directory. Reading security.json could disclose the JWT signing secret, user password hashes, and the material needed to forge an admin token. The advisory also describes command execution through the provider configuration.
The affected package ranges are @signalk/resources-provider 1.0.0 through 1.5.2 and signalk-server 2.0.0 through 2.33.x. Fixed versions are 1.5.3 and 2.34.0. On default deployments with allow_readonly=false, anonymous requests receive 401, but a readonly user token can still reach the vulnerable path.
Why the visibility condition matters
The advisory calls out allow_readonly=true, a supported and UI-toggleable configuration that grants anonymous read access. That setting expands the population of principals who can reach the resources API. It does not prove that every title or body match has readonly access enabled.
The title and body counts show that Signal K is named in several indexed pages, but they do not identify a deployment, version, or configuration. A title can be a documentation page or a custom dashboard. A body match is even broader. The external result is a lead, not a vulnerability census.
A safe inventory path
Find Signal K servers through the marine or vessel network inventory, then confirm the package version through the application runtime. Check allow_readonly, reverse-proxy rules, and whether signalk-server is reachable from untrusted networks. Upgrade to the fixed releases and review provider configuration for Execute providers that were not authorized.
If the server is internet-facing, review access logs for encoded traversal in resource paths, requests to security.json, and authenticated actions that were not preceded by a normal login. Rotate the JWT signing secret and user passwords if the configuration file may have been read.
What to keep separate
The title count of 558 and body count of 1,085 are observations from one query window with page 1, pagesize=1, and sub_type=all. They do not tell the reader whether a listed page belongs to a vessel, a marina, a developer, or a documentation site.
That separation is the useful part of the article. ZoomEye can surface a named technology that may be missing from the CMDB. The security team still needs version and configuration evidence before it can make a patch or exposure decision.
