CVE-2026-47735: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Basekick-Labs arc

Arc is an open, SQL-native time-series database that prior to version 26.06.1 had an insufficient user-SQL validation mechanism. The validator blocked only specific DuckDB I/O functions like read_parquet and arc_partition_agg using a regex denylist, but many other functions such as read_csv_auto, read_json, glob, and others were not blocked. Additionally, RBAC table-reference extraction inspected only FROM and JOIN clauses, allowing scalar table functions in SELECT lists to bypass these restrictions. This flaw permitted path traversal attacks by opening files outside intended directories. The vulnerability is addressed in version 26.06.1 by adding a structural sandbox at the DuckDB layer, which enforces an allowlist for file access and disables further INSTALL/LOAD commands for extensions, though already-loaded extensions remain usable.

An attacker with at least low privileges can exploit this vulnerability to perform path traversal attacks, potentially accessing unauthorized files on the server hosting Arc. This could lead to exposure of sensitive data or unauthorized information disclosure. The CVSS 4.0 score of 7.1 (high severity) reflects the network attack vector, low attack complexity, no user interaction, and high impact on confidentiality. There is no indication of privilege escalation or integrity/availability impact.

A fix is available in Arc version 26.06.1, which implements a structural sandbox at the DuckDB layer to restrict file access to an allowlist and disable further extension INSTALL/LOAD commands. Until upgrading, it is recommended to restrict API access to trusted networks using firewall rules. As a temporary mitigation, administrators can add functions like read_csv*, read_json*, and glob to the dangerousSQLPattern denylist in internal/api/query.go to block these potentially dangerous SQL patterns.