CVE-2026-33922
MediumCVSS 6.0Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
A path traversal vulnerability was discovered in the Offline archives functionality of the local web interface due to insufficient validation of an input parameter. A local user with administrative credentials for the web interface could submit an archive name containing traversal sequences and delete arbitrary files reachable by the Arc process, which runs with administrative privileges on the host.
Risk Assessment
An attacker with admin interface access can delete critical system files, leading to system failure or data loss.
Recommendation
Apply the patch that adds proper validation of archive names and restrict access to the admin interface to trusted individuals.
Other vulnerabilities in Arc
See all- CVE-2026-94181High
The Arc browser in affected versions contains an address bar spoofing issue. An attacker can use a <select> element that triggers requestFullscreen without displaying the fullscreen notification to spoof the browser address bar.
- CVE-2026-48106High
Arc Enterprise prior to version 26.06.1 validates only the wire-format envelope (length, opcode) of inbound messages in the cluster replication receiver. The MsgReplicateSync payload is accepted without any application-layer authentication (no HMAC, signature, or per-message nonce). Transport-layer TLS/mTLS does not protect against application-layer tampering or replay. Fixed in 2026.06.1.
- CVE-2026-48105High
Arc Enterprise prior to version 26.06.1 accepts attacker-chosen file paths in manifest-registration proposals in the Raft FSM without validating them against the configured storage backend. The only check is that the path is non-empty; there is no parent-traversal rejection, allowlist, scheme restriction, or length bound. Fixed in 2026.06.1.
- CVE-2026-48050High
Arc versions prior to 26.06.1 register Go's net/http/pprof handlers at /debug/pprof/* and add /debug/pprof to PublicPrefixes, making these endpoints reachable without authentication. Version 26.06.1 contains a patch. Workarounds include blocking /debug/pprof* at a reverse proxy or restricting the API port to trusted networks.
- CVE-2026-47735High
Arc prior to version 26.06.1 blocked only read_parquet( and arc_partition_agg( via regex denylist in the user-SQL validator. Other DuckDB I/O functions (read_csv, read_json, glob, etc.) were not blocked. RBAC table-reference extraction only inspected FROM/JOIN clauses, so scalar table functions in SELECT slipped past. Fixed in 26.06.1 via a structural sandbox at the DuckDB layer.
Original NVD description (English source)
A path traversal vulnerability was discovered in the Offline archives functionality of the local web interface due to insufficient validation of an input parameter. A local user with administrative credentials for the web interface could submit an archive name containing traversal sequences and delete arbitrary files reachable by the Arc process, which runs with administrative privileges on the host.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS