Read the docs
TI-2026-34768 Aliases CVE-2026-47179GHSA-c3px-h233-h6fq

Arcane: Authenticated Arbitrary Host File Read via Docker Compose Include Directives in Arcane

Priority LOW 33CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.

Summary

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.4, ProjectService.GetProjectFileContent returns the contents of any Docker Compose include directive declared in a project's compose file before any path-traversal validation runs. Because ProjectService.CreateProject writes attacker-supplied compose content to disk without validating include paths, an authenticated user can create a project whose compose file declares include: ['../../../../etc/passwd'], then read the include via the project file API. The result is arbitrary read of any file readable by the Arcane backend process, including /app/data/arcane.db (the SQLite database containing every user's password hash and API key), enabling escalation to admin and, via Arcane's Docker control plane, RCE on the host. This vulnerability is fixed in 1.19.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00307 23rd percentileScored 2026-11-07
Fix Fixed arcane (getarcaneapp): 1.19.4github.com/getarcaneapp/arcane/backend (Go): 1.19.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
getarcaneapparcanebefore 1.19.41.19.4Patch availableCNA
—github.com/getarcaneapp/arcane/backend (Go)before 1.19.41.19.4Patch availableGHSA-c3px-h233-h6fq
  • arcane Vendorgetarcaneapp Affected before 1.19.4 Fixed in 1.19.4 Patch available CNA
  • github.com/getarcaneapp/arcane/backend (Go) Vendor— Affected before 1.19.4 Fixed in 1.19.4 Patch available GHSA-c3px-h233-h6fq

Remediation

  • Fix · CNA arcane (getarcaneapp) Fixed in 1.19.4
  • Fix · GHSA-c3px-h233-h6fq github.com/getarcaneapp/arcane/backend (Go) Fixed in 1.19.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-47179
  2. 2026-10-03 Alias added: GHSA-c3px-h233-h6fq

References

Advisory 1

Other 3

  • TI-2026-33369 Missing authorization in getarcaneapp arcane CVSS 3.1CRITICAL 9.9
  • TI-2026-75557 Arcane users with delegated permission can take over admin accounts CVSS 3.1HIGH 8.8
  • TI-2026-34717 Arcane: Missing admin authorization on global variables endpoint CVSS 3.1HIGH 8.8
  • TI-2026-75556 Credential exfiltration in Arcane via registry URL repointing CVSS 3.1HIGH 8.5
  • TI-2026-33371 Arcane: Unauthenticated reflected XSS via SVG color parameter in /api/app-images/logo enables admin account takeover CVSS 3.1HIGH 8.2
  • TI-2026-58913 Arcane before 2.0.0 Missing Administrator Authorization on the Compose Template Mutation Endpoints CVSS 4.0HIGH 7.1
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences