CVE-2026-47179: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in getarcaneapp arcane
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.4, ProjectService.GetProjectFileContent returns the contents of any Docker Compose include directive declared in a project's compose file before any path-traversal validation runs. Because ProjectService.CreateProject writes attacker-supplied compose content to disk without validating include paths, an authenticated user can create a project whose compose file declares include: ['../../../../etc/passwd'], then read the include via the project file API. The result is arbitrary read of any file readable by the Arcane backend process, including /app/data/arcane.db (the SQLite database containing every user's password hash and API key), enabling escalation to admin and, via Arcane's Docker control plane, RCE on the host. This vulnerability is fixed in 1.19.4.
AI Analysis
Technical Summary
Arcane versions before 1.19.4 have a path traversal vulnerability (CWE-22) in ProjectService.GetProjectFileContent and ProjectService.CreateProject. The service returns contents of Docker Compose include directives before validating paths, allowing an authenticated attacker to specify include paths like '../../../../etc/passwd' to read arbitrary files. This includes sensitive files such as /app/data/arcane.db, which stores password hashes and API keys. Access to these credentials can lead to escalation to admin privileges and remote code execution through Arcane's Docker control capabilities. The vulnerability has a CVSS 3.1 score of 7.7 (high severity) and is fixed in version 1.19.4.
Potential Impact
An authenticated user can exploit this vulnerability to read arbitrary files accessible by the Arcane backend process, including sensitive credential stores. This exposure can lead to privilege escalation to administrative access and remote code execution on the host system via Docker control. There are no known exploits in the wild at this time.
Mitigation Recommendations
This vulnerability is fixed in Arcane version 1.19.4. Users should upgrade to version 1.19.4 or later to remediate the issue. No other official remediation or temporary fixes are documented. Patch status is confirmed by the vendor advisory stating the fix is included in 1.19.4.
CVE-2026-47179: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in getarcaneapp arcane
Description
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.4, ProjectService.GetProjectFileContent returns the contents of any Docker Compose include directive declared in a project's compose file before any path-traversal validation runs. Because ProjectService.CreateProject writes attacker-supplied compose content to disk without validating include paths, an authenticated user can create a project whose compose file declares include: ['../../../../etc/passwd'], then read the include via the project file API. The result is arbitrary read of any file readable by the Arcane backend process, including /app/data/arcane.db (the SQLite database containing every user's password hash and API key), enabling escalation to admin and, via Arcane's Docker control plane, RCE on the host. This vulnerability is fixed in 1.19.4.
CVSS v3.1
Score 7.7high
Affected software
pkg:github/getarcaneapp/arcaneRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Arcane versions before 1.19.4 have a path traversal vulnerability (CWE-22) in ProjectService.GetProjectFileContent and ProjectService.CreateProject. The service returns contents of Docker Compose include directives before validating paths, allowing an authenticated attacker to specify include paths like '../../../../etc/passwd' to read arbitrary files. This includes sensitive files such as /app/data/arcane.db, which stores password hashes and API keys. Access to these credentials can lead to escalation to admin privileges and remote code execution through Arcane's Docker control capabilities. The vulnerability has a CVSS 3.1 score of 7.7 (high severity) and is fixed in version 1.19.4.
Potential Impact
An authenticated user can exploit this vulnerability to read arbitrary files accessible by the Arcane backend process, including sensitive credential stores. This exposure can lead to privilege escalation to administrative access and remote code execution on the host system via Docker control. There are no known exploits in the wild at this time.
Mitigation Recommendations
This vulnerability is fixed in Arcane version 1.19.4. Users should upgrade to version 1.19.4 or later to remediate the issue. No other official remediation or temporary fixes are documented. Patch status is confirmed by the vendor advisory stating the fix is included in 1.19.4.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-18T21:25:34.498Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a19cdf6e29bf47b50fb479f
Added to database: 05/29/2026, 17:33:42 UTC
Last enriched: 06/05/2026, 20:45:10 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 70
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.