# CVE-2026-47179: Arcane path traversal in Docker Compose include directives

Source: https://junglewise.ai/threats/cve-2026-47179-arcane-path-traversal-in-docker-compose-include-directives  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-29. Updated: 2026-05-29  
License: CC BY 4.0 with a link back

CVE-2026-47179 · Severity: high · CVSS 7.7 · Published 2026-05-29

Arcane is a management interface for Docker containers and infrastructure. A security flaw allows any logged-in user to read sensitive files from the server's file system, such as the application's database containing password hashes and API keys. This access can be used to take over administrator accounts and potentially gain full control over the host server.

Technologies: [Arcane backend](https://junglewise.ai/threats/technologies/arcane-backend), [github.com/getarcaneapp/arcane/backend (Go)](https://junglewise.ai/threats/technologies/github-com-getarcaneapp-arcane-backend). Vendors: [Arcane](https://junglewise.ai/threats/vendors/arcane), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-47179 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47179 being exploited in the wild.

**How severe is CVE-2026-47179?** High severity, with a CVSS score of 7.7, published 29 May 2026.

**Which products and versions are affected?** Arcane backend <= 1.19.3; github.com/getarcaneapp/arcane/backend (Go) <= 1.19.3, SEMVER:introduced=0,fixed=1.19.4.

**Is there a fix for CVE-2026-47179?** Yes. github.com/getarcaneapp/arcane/backend (Go): upgrade to 1.19.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-47179 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-47179?** Check whether you run Arcane backend or github.com/getarcaneapp/arcane/backend (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/getarcaneapp/arcane/backend (Go): upgrade to 1.19.4 or later

  ```sh
  go get github.com/getarcaneapp/arcane/backend@v1.19.4
  ```


## Technical details

A path traversal vulnerability exists in Arcane's ProjectService. The 'CreateProject' function fails to validate 'include' paths in attacker-supplied Docker Compose files, allowing them to be written to disk. Subsequently, 'GetProjectFileContent' retrieves the contents of these included files before performing path-traversal validation. An authenticated attacker with 'user' privileges can create a project with a malicious include directive (e.g., pointing to /etc/passwd or the application's SQLite database) and read the file via the API. This allows for the extraction of password hashes and API keys, enabling privilege escalation to admin and subsequent Remote Code Execution (RCE) via the Docker control plane.

## Affected products

- getarcaneapp Arcane <= 1.19.3

## Identifiers

- CVE-2026-47179
- GHSA-c3px-h233-h6fq
- GO-2026-5308

## Timeline

- 2026-05-17: patched: Fix committed to repository.
- 2026-05-18: advisory: GitHub Security Advisory published.
- 2026-05-29: disclosed: CVE published to NVD.

## References

- [https://github.com/getarcaneapp/arcane/commit/b6cbffabf61dbc3f12a28d3b5830e3c6b7e67daf](https://github.com/getarcaneapp/arcane/commit/b6cbffabf61dbc3f12a28d3b5830e3c6b7e67daf)
- [https://github.com/getarcaneapp/arcane/security/advisories/GHSA-c3px-h233-h6fq](https://github.com/getarcaneapp/arcane/security/advisories/GHSA-c3px-h233-h6fq)

## Related threats

- [Arcane authorization bypass in pprof diagnostic endpoints](https://junglewise.ai/threats/cve-2026-96628-arcane-environment-access-token-bypasses-the-admin-required)
- [Arcane users:update permission allows admin account takeover via password reset](https://junglewise.ai/threats/cve-2026-96627-arcane-delegated-users-update-permission-allows-admin-account)
- [Arcane missing authorization in global variables endpoint](https://junglewise.ai/threats/cve-2026-47125-arcane-missing-authorization-in-global-variables-endpoint)
- [getarcaneapp Arcane reflected XSS in logo endpoint](https://junglewise.ai/threats/cve-2026-45627-getarcaneapp-arcane-reflected-xss-in-logo-endpoint)
- [Arcane OS command injection in volume browser](https://junglewise.ai/threats/cve-2026-45626-arcane-os-command-injection-in-volume-browser)