CVE-2026-45626
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
In Arcane 1.18.1 and earlier, the GET /environments/{id}/volumes/{volumeName}/browse endpoint accepts a path query parameter that is passed to a shell command (sh -c "find … | while …") inside an Arcane helper container. The path sanitizer blocks ../ traversal but does not strip Bourne-shell metacharacters such as $() or backticks, and strconv.Quote only escapes Go string metacharacters, not shell substitution sequences. Any authenticated user with access to a browseable volume can execute arbitrary commands inside the helper container; command output is reflected back in the 500 error body.
Risk Assessment
An attacker can execute arbitrary commands in the helper container, potentially leading to privilege escalation, data leakage, or further attacks on the Docker infrastructure.
Recommendation
Update Arcane to a version that includes a fix to remove shell metacharacters from the path parameter or use a safer mechanism for path processing.
Other vulnerabilities in Arcane
See all- CVE-2026-45625Critical
Arcane prior to version 1.19.0 has a vulnerability where eight REST API endpoints related to Git repositories lack admin role verification. This allows any logged-in user with the default user role to manage Git repository configurations and exfiltrate stored credentials (PATs, SSH keys) by repointing a repository to an attacker-controlled host.
- CVE-2026-86114Medium
Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to create, modify, and delete compose templates including instance-wide defaults. Attackers can inject malicious container configurations with privileged settings or host path mounts that execute with administrative privileges when deployed by administrators.
- CVE-2026-47125High
Arcane, an interface for managing Docker containers, before version 1.19.2 contains a vulnerability due to missing admin authorization check on the PUT /api/environments/{id}/templates/variables endpoint. Any authenticated non-admin user can overwrite global environment variables used across all projects.
- CVE-2026-42461High
In Arcane prior to version 1.18.0, four GET endpoints under /api/templates* lack authentication, allowing unauthenticated clients to read the full Compose YAML and .env content of every template, including sensitive data such as database passwords and API keys.
- CVE-2025-69031Medium
The Arcane plugin for WordPress contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 3.6.6.
Original NVD description (English source)
Arcane is an interface for managing Docker containers, images, networks, and volumes. In 1.18.1 and earlier, GET /environments/{id}/volumes/{volumeName}/browse accepts a path query parameter that is passed to a shell command (sh -c "find … | while …") inside an Arcane helper container. The path sanitiser blocks ../ traversal but does not strip Bourne-shell metacharacters such as $() or backticks, and strconv.Quote only escapes Go string metacharacters, not shell substitution sequences. Any authenticated user with access to a browseable volume can execute arbitrary commands inside the helper container; command output is reflected back in the 500 error body.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS