Vulnerabilities

TI-2023-05470 CVE-2023-5938 · GHSA-585p-p962-9hrc

Path traversal via 'zip slip' in Arc before v1.6.0

MEDIUM 40

Multiple functions use archives without properly validating the filenames therein, rendering the application vulnerable to path traversal via 'zip slip' attacks.

CVSS 4.0HIGH 8.9 Network High privileges No interaction EPSS 0.00673 Published 2024-05-15 Fixed in 1.6.0 CWE-22

TI-2023-05469 CVE-2023-5937 · GHSA-jwfg-733h-8pc5

Sensitive data exfiltration via unsafe permissions on Windows systems in Arc before v1.6.0

LOW 23

On Windows systems, the Arc configuration files resulted to be world-readable.

CVSS 4.0MEDIUM 5.2 Local Low privileges No interaction EPSS 0.00145 Published 2024-05-15 Fixed in 1.6.0 CWE-538

TI-2023-05468 CVE-2023-5936 · GHSA-r73q-j7fc-5g2p

Unsafe temporary data privileges on Unix systems in Arc before v1.6.0

LOW 33

On Unix systems (Linux, MacOS), Arc uses a temporary file with unsafe privileges.

CVSS 4.0HIGH 7.3 Local Low privileges User interaction EPSS 0.00147 Published 2024-05-15 Fixed in 1.6.0 CWE-732

TI-2023-05467 CVE-2023-5935 · GHSA-rc98-whmj-qg8f

Missing authentication for local web interface in Arc before v1.6.0

LOW 33

When configuring Arc (e.g.

CVSS 4.0HIGH 7.3 Local No auth User interaction EPSS 0.00157 Published 2024-05-15 Fixed in 1.6.0 CWE-306

Vulnerabilities

Filters

Path traversal via 'zip slip' in Arc before v1.6.0

Sensitive data exfiltration via unsafe permissions on Windows systems in Arc before v1.6.0

Unsafe temporary data privileges on Unix systems in Arc before v1.6.0

Missing authentication for local web interface in Arc before v1.6.0