Description
Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal state (`restoreFilePath`) of the server via the `/skServer/validateBackup` endpoint. This allows the attacker to hijack the administrator's "Restore" functionality to overwrite critical server configuration files (e.g., `security.json`, `package.json`), leading to account takeover and Remote Code Execution (RCE). Version 2.19.0 patches this vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SignalK | signalk-server | < 2.19.0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
joshuavanderpoll/cve-2025-66398 ★ 3 · Mar 10, 2026
CVE-2025-66398 — Signal K Server ≤ 2.18.0 RCE PoC
-
showy-headteacher114/cve-2025-66398 ★ 1 · Mar 23, 2026
Demonstrate exploitation of Signal K Server CVE-2025-66398 allowing unauthenticated attackers to inject backdoor and enable remote code execution.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | signalk-server | < 2.19.0 | 2.19.0 | GHSA-w3x5-7c4c-66p9 |