CVE-2026-48105: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Basekick-Labs arc

Arc Enterprise's Raft FSM component (internal/cluster/raft/fsm.go:applyRegisterFile) improperly limits pathname input by accepting attacker-chosen file paths in manifest-registration proposals without validating them against the configured storage backend. The only validation is that the path is non-empty; there is no rejection of parent directory traversal sequences ('..'), no allowlist of legitimate path prefixes, no scheme restrictions (e.g., distinguishing between s3:// and local paths), and no length bounds. This allows an attacker with cluster-level privileges to specify arbitrary file paths, potentially leading to unauthorized file access or modification. The issue is resolved in Arc Enterprise version 26.06.1.

An attacker with at least limited privileges in the cluster can submit manifest-registration proposals containing crafted file paths that bypass intended storage backend restrictions. This can lead to unauthorized file access or manipulation outside the designated storage area, potentially impacting data integrity or confidentiality. The vulnerability has a high severity score (CVSS 8.3) but no known exploits in the wild have been reported.

A patch is available in version 26.06.1 that fixes the path validation issue. Until the patch can be applied, it is recommended to restrict cluster network access to known and trusted peers using strict firewall rules, audit cluster manifests for unexpected or suspicious file paths that do not match the configured storage backend root, and consider disabling cluster mode to prevent exploitation.