Executive brief
Arcane is a management interface for Docker containers and infrastructure. A security flaw allows any logged-in user to read sensitive files from the server's file system, such as the application's database containing password hashes and API keys. This access can be used to take over administrator accounts and potentially gain full control over the host server.
Technical details
A path traversal vulnerability exists in Arcane's ProjectService. The 'CreateProject' function fails to validate 'include' paths in attacker-supplied Docker Compose files, allowing them to be written to disk. Subsequently, 'GetProjectFileContent' retrieves the contents of these included files before performing path-traversal validation. An authenticated attacker with 'user' privileges can create a project with a malicious include directive (e.g., pointing to /etc/passwd or the application's SQLite database) and read the file via the API. This allows for the extraction of password hashes and API keys, enabling privilege escalation to admin and subsequent Remote Code Execution (RCE) via the Docker control plane.
Affected products
- getarcaneapp Arcane <= 1.19.3
Timeline
- 2026-05-17: patched: Fix committed to repository.
- 2026-05-18: advisory: GitHub Security Advisory published.
- 2026-05-29: disclosed: CVE published to NVD.