CVE-2026-45626
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
In Arcane 1.18.1 and earlier, the GET /environments/{id}/volumes/{volumeName}/browse endpoint accepts a path query parameter that is passed to a shell command (sh -c "find … | while …") inside an Arcane helper container. The path sanitizer blocks ../ traversal but does not strip Bourne-shell metacharacters such as $() or backticks, and strconv.Quote only escapes Go string metacharacters, not shell substitution sequences. Any authenticated user with access to a browseable volume can execute arbitrary commands inside the helper container; command output is reflected back in the 500 error body.
Risk Assessment
An attacker can execute arbitrary commands in the helper container, potentially leading to privilege escalation, data leakage, or further attacks on the Docker infrastructure.
Recommendation
Update Arcane to a version that includes a fix to remove shell metacharacters from the path parameter or use a safer mechanism for path processing.
Other vulnerabilities in Arcane
See all- CVE-2026-45625Critical
Arcane prior to version 1.19.0 has a vulnerability where eight REST API endpoints related to Git repositories lack admin role verification. This allows any logged-in user with the default user role to manage Git repository configurations and exfiltrate stored credentials (PATs, SSH keys) by repointing a repository to an attacker-controlled host.
- CVE-2026-47125High
Arcane, an interface for managing Docker containers, before version 1.19.2 contains a vulnerability due to missing admin authorization check on the PUT /api/environments/{id}/templates/variables endpoint. Any authenticated non-admin user can overwrite global environment variables used across all projects.
- CVE-2026-42461High
In Arcane prior to version 1.18.0, four GET endpoints under /api/templates* lack authentication, allowing unauthenticated clients to read the full Compose YAML and .env content of every template, including sensitive data such as database passwords and API keys.
Original NVD description (English source)
Arcane is an interface for managing Docker containers, images, networks, and volumes. In 1.18.1 and earlier, GET /environments/{id}/volumes/{volumeName}/browse accepts a path query parameter that is passed to a shell command (sh -c "find … | while …") inside an Arcane helper container. The path sanitiser blocks ../ traversal but does not strip Bourne-shell metacharacters such as $() or backticks, and strconv.Quote only escapes Go string metacharacters, not shell substitution sequences. Any authenticated user with access to a browseable volume can execute arbitrary commands inside the helper container; command output is reflected back in the 500 error body.