CVE-2026-47179
published 2026-05-29CVE-2026-47179: Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.4, ProjectService.GetProjectFileContent returns the…
PriorityP352high7.7CVSS 3.1
AVNACLPRLUINSCCHINAN
EPSS
0.31%
22.3th percentile
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.4, ProjectService.GetProjectFileContent returns the contents of any Docker Compose include directive declared in a project's compose file before any path-traversal validation runs. Because ProjectService.CreateProject writes attacker-supplied compose content to disk without validating include paths, an authenticated user can create a project whose compose file declares include: ['../../../../etc/passwd'], then read the include via the project file API. The result is arbitrary read of any file readable by the Arcane backend process, including /app/data/arcane.db (the SQLite database containing every user's password hash and API key), enabling escalation to admin and, via Arcane's Docker control plane, RCE on the host. This vulnerability is fixed in 1.19.4.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| getarcaneapp | arcane | < 1.19.4 | 1.19.4 |
| github.com | getarcaneapp_arcane_backend | >= 0 < 1.19.4 | 1.19.4 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
getarcaneapp arcane up to 1.19.3 Project File API ProjectService.CreateProject path traversal (GHSA-c3px-h233-h6fq)
vuldb·2026-05-29·CVSS 7.7
CVE-2026-47179 [HIGH] getarcaneapp arcane up to 1.19.3 Project File API ProjectService.CreateProject path traversal (GHSA-c3px-h233-h6fq)
A vulnerability was found in getarcaneapp arcane up to 1.19.3 and classified as critical. Affected is the function ProjectService.CreateProject of the component Project File API. Such manipulation leads to path traversal.
This vulnerability is uniquely identified as CVE-2026-47179. The attack can be launched remotely. No exploit exists.
It is suggested to upgrade the affected component.
GHSA
Arcane Has an Authenticated Arbitrary Host File Read via Docker Compose Include Directives
ghsa·2026-05-28
CVE-2026-47179 [HIGH] CWE-22 Arcane Has an Authenticated Arbitrary Host File Read via Docker Compose Include Directives
Arcane Has an Authenticated Arbitrary Host File Read via Docker Compose Include Directives
## Summary
`ProjectService.GetProjectFileContent` returns the contents of any Docker Compose include directive declared in a project's compose file before any path-traversal validation runs. Because `ProjectService.CreateProject` writes attacker-supplied compose content to disk without validating include paths, an authenticated user can create a project whose compose file declares `include: ['../../../../etc/passwd']`, then read the include via the project file API. The result is arbitrary read of any file readable by the Arcane backend process, including `/app/data/arcane.db` (the SQLite database containing every user's password hash and API key), enabling escalation to admin and, via Arcane's Doc
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-05-29
Published