ETK-2026-2006Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-2006",
  "cve_id": null,
  "display_id": "ETK-2026-2006",
  "ghsa_id": "GHSA-4xm8-rg9h-jhq2",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Path traversal in signalk-server resource APIs",
  "summary": "signalk-server releases before 2.34.0 and @signalk/resources-provider releases before 1.5.3 can allow resource API requests to access files beyond the intended storage area. An attacker may read, alter, or remove exposed files and could escalate further if sensitive configuration data is accessible; anonymous access requires `allow_readonly=true`, while other deployments require read-only credentials.",
  "mitigation": "Upgrade signalk-server to 2.34.0 or later and @signalk/resources-provider to 1.5.3 or later. Until updates are applied, disable anonymous read-only access and limit resource API access to trusted users and networks.",
  "vendor": "npm",
  "product": "npm:signalk-server",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 2.0.0"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "2.34.0"
      ],
      "package_name": "signalk-server",
      "purl": "pkg:npm/signalk-server"
    },
    {
      "affected_notes": [
        "1.0.0 - 1.5.2"
      ],
      "affected_ranges": [],
      "ecosystem": "npm",
      "fixed_versions": [
        "1.5.3"
      ],
      "package_name": "@signalk/resources-provider",
      "purl": "pkg:npm/@signalk/resources-provider"
    }
  ],
  "cwes": [
    22
  ],
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 19.959615833333334,
  "t0_at": null,
  "signals": {
    "check": {
      "at": "2026-10-18T20:02:45.075601+00:00",
      "days": -2.8667057044791666,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T16:50:48.586144+00:00",
      "url": null
    },
    "public_poc": {
      "at": "2026-10-18T19:03:54+00:00",
      "days": -2.9075746350462963,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T16:50:48.586144+00:00",
      "url": "https://github.com/SignalK/signalk-server/security/advisories/GHSA-4xm8-rg9h-jhq2"
    },
    "trigger_signal": {
      "at": "2026-10-18T19:03:54+00:00",
      "days": -2.9075746350462963,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T16:50:48.586144+00:00",
      "url": "https://github.com/SignalK/signalk-server/security/advisories/GHSA-4xm8-rg9h-jhq2"
    }
  }
}