Arcane versions before 1.19.4 contain a path traversal vulnerability (CWE-22) in ProjectService.GetProjectFileContent and ProjectService.CreateProject. The service returns contents of Docker Compose include directives before validating paths, allowing an authenticated user to specify include paths like '../../../../etc/passwd'. This results in arbitrary file reads of any file accessible by the Arcane backend process, including sensitive files such as /app/data/arcane.db, which stores password hashes and API keys. Exploiting this can escalate privileges to admin and enable remote code execution on the host through Arcane's Docker control plane. The vulnerability is fixed in version 1.19.4.

An authenticated attacker can read arbitrary files on the backend server, including sensitive credential storage, leading to privilege escalation to administrative access. This escalated access can then be leveraged to execute arbitrary code on the host system via Docker control, posing a significant risk to confidentiality and system integrity. The CVSS score of 7.7 reflects high severity with network attack vector, low attack complexity, and no user interaction required.

This vulnerability is fixed in Arcane version 1.19.4. Users should upgrade to version 1.19.4 or later to remediate this issue. No vendor advisory is provided to indicate alternative mitigations or temporary fixes. Until upgraded, restrict authenticated user permissions to minimize risk.