CVE-2026-48105: Arc Enterprise path traversal in Raft FSM file registration

CVE-2026-48105 · Severity: info · CVSS 8.8 · Published 2026-08-21

Arc Enterprise is a time-series database used for telemetry that supports clustering across multiple nodes. The vulnerability allows an attacker with cluster credentials or who compromises a single node to register arbitrary file paths, enabling them to inject malicious data or read sensitive files across the entire cluster. Once exploited on one node, the malicious paths replicate automatically to all cluster peers, creating a widespread data compromise.

Vendors: Basekick Labs.

Quick answers

Is CVE-2026-48105 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-48105 being exploited in the wild.
How severe is CVE-2026-48105?
Informational severity, with a CVSS score of 8.8, published 21 August 2026.
Which products and versions are affected?
Basekick Labs Arc Enterprise <= 2026.05.1.
Is there a fix for CVE-2026-48105?
A patch was published on 2026-06-01: Fixed in version 2026.06.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48105 attacked?
It is attacked over the network or from the adjacent network.
Am I affected by CVE-2026-48105?
Check whether you run Basekick Labs Arc Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a path-traversal and insufficient input validation flaw in Arc Enterprise's Raft FSM (`internal/cluster/raft/fsm.go:applyRegisterFile`). The function accepts attacker-controlled file paths in manifest-registration Raft proposals with only a check that the path is non-empty; there is no rejection of parent-traversal sequences (`..`), no allowlist enforcement against the configured storage backend root, no scheme restriction (local vs. S3), and no path-length bounds. An attacker with valid cluster credentials or node access can propose Raft entries registering arbitrary paths (e.g., `/etc/passwd`, `s3://attacker-controlled-bucket/poisoned.parquet`, or `../../etc/shadow`), which are then written to the authoritative cluster manifest and replicated to every peer. Affected versions are prior to 2026.06.1; the fix validates paths, rejects parent-traversal and out-of-scope absolute paths, enforces backend-specific scheme validation, and applies length limits.

Affected products

  • Basekick Labs Arc Enterprise <= 2026.05.1

Timeline

  • 2026-05-31: disclosed: Advisory published on GitHub
  • 2026-06-01: patched: Fixed in version 2026.06.1
  • 2026-08-21: other: NVD entry published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.