Signal K server GHSA-4xm8-rg9h-jhq2: path traversal in the resources / applicationData APIs can read security.json (JWT signing secret) and lead to admin access and remote code execution. Which signalk-server version fixes it?

What it is: A critical advisory published 2026-10-30 for signalk-server, the open-source marine data server used on boats and in marine IoT setups (often on a Raspberry Pi). Its resources and applicationData APIs did not validate resource IDs, so an unauthenticated or low-privileged user could read, write and delete files outside the storage folder. Reading the server's security.json exposes the JWT signing secret and password hashes, which lets someone forge an admin token and from there run code. Servers that allow anonymous read-only access (the allow_readonly option) are reachable without any login. Am I affected: - signalk-server 2.0.0 up to (not including) 2.34.0, and the @signalk/resources-provider plugin 1.0.0 up to (not including) 1.5.3. - Check the version in the Signal K admin UI (Server > Settings or the About page), or with npm ls -g signalk-server on the host. - Highest risk: servers reachable from the internet or shared networks (marina Wi-Fi), or with read-only anonymous access turned on. Fix: 1. Upgrade signalk-server to 2.34.0 or later and the resources-provider plugin to 1.5.3 or later (through the admin UI's server update, npm, or your Docker image tag), then restart. 2. Because the signing secret may have been read, treat it as exposed: generate a new secret (delete the stored secret and let the server create one, per the project docs), then reset all user passwords and log everyone in again. 3. Turn off anonymous read access unless you really need it, and don't expose the server to the internet; use a VPN for remote access. 4. If the server was exposed, check for unexpected admin users, plugins or changed files in the config folder, and rebuild if anything looks wrong. Verify: the server reports 2.34.0+, old tokens are rejected after the secret change, and the server isn't reachable from untrusted networks. Sources: https://github.com/SignalK/signalk-server/security/advisories/GHSA-4xm8-rg9h-jhq2 https://github.com/SignalK/signalk-server/releases/tag/v2.34.0 https://github.com/advisories/GHSA-4xm8-rg9h-jhq2