CVE-2026-33922
MediumCVSS 6.0Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
A path traversal vulnerability was discovered in the Offline archives functionality of the local web interface due to insufficient validation of an input parameter. A local user with administrative credentials for the web interface could submit an archive name containing traversal sequences and delete arbitrary files reachable by the Arc process, which runs with administrative privileges on the host.
Risk Assessment
An attacker with admin interface access can delete critical system files, leading to system failure or data loss.
Recommendation
Apply the patch that adds proper validation of archive names and restrict access to the admin interface to trusted individuals.
Original NVD description (English source)
A path traversal vulnerability was discovered in the Offline archives functionality of the local web interface due to insufficient validation of an input parameter. A local user with administrative credentials for the web interface could submit an archive name containing traversal sequences and delete arbitrary files reachable by the Arc process, which runs with administrative privileges on the host.