CVE-2026-47179

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-47179", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-18T21:25:34.498Z", "datePublished": "2026-05-29T17:06:34.169Z", "dateUpdated": "2026-06-02T15:46:26.827Z"}, "containers": {"cna": {"title": "Arcane: Authenticated Arbitrary Host File Read via Docker Compose Include Directives in Arcane", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/getarcaneapp/arcane/security/advisories/GHSA-c3px-h233-h6fq", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/getarcaneapp/arcane/security/advisories/GHSA-c3px-h233-h6fq"}, {"name": "https://github.com/getarcaneapp/arcane/commit/b6cbffabf61dbc3f12a28d3b5830e3c6b7e67daf", "tags": ["x_refsource_MISC"], "url": "https://github.com/getarcaneapp/arcane/commit/b6cbffabf61dbc3f12a28d3b5830e3c6b7e67daf"}], "affected": [{"vendor": "getarcaneapp", "product": "arcane", "versions": [{"version": "< 1.19.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-29T17:06:34.169Z"}, "descriptions": [{"lang": "en", "value": "Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.4, ProjectService.GetProjectFileContent returns the contents of any Docker Compose include directive declared in a project's compose file before any path-traversal validation runs. Because ProjectService.CreateProject writes attacker-supplied compose content to disk without validating include paths, an authenticated user can create a project whose compose file declares include: ['../../../../etc/passwd'], then read the include via the project file API. The result is arbitrary read of any file readable by the Arcane backend process, including /app/data/arcane.db (the SQLite database containing every user's password hash and API key), enabling escalation to admin and, via Arcane's Docker control plane, RCE on the host. This vulnerability is fixed in 1.19.4."}], "source": {"advisory": "GHSA-c3px-h233-h6fq", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-02T15:44:09.404804Z", "id": "CVE-2026-47179", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-02T15:46:26.827Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-47179", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-02T15:44:09.404804Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-02T15:44:14.411Z"}}], "cna": {"title": "Arcane: Authenticated Arbitrary Host File Read via Docker Compose Include Directives in Arcane", "source": {"advisory": "GHSA-c3px-h233-h6fq", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "getarcaneapp", "product": "arcane", "versions": [{"status": "affected", "version": "< 1.19.4"}]}], "references": [{"url": "https://github.com/getarcaneapp/arcane/security/advisories/GHSA-c3px-h233-h6fq", "name": "https://github.com/getarcaneapp/arcane/security/advisories/GHSA-c3px-h233-h6fq", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/getarcaneapp/arcane/commit/b6cbffabf61dbc3f12a28d3b5830e3c6b7e67daf", "name": "https://github.com/getarcaneapp/arcane/commit/b6cbffabf61dbc3f12a28d3b5830e3c6b7e67daf", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.4, ProjectService.GetProjectFileContent returns the contents of any Docker Compose include directive declared in a project's compose file before any path-traversal validation runs. Because ProjectService.CreateProject writes attacker-supplied compose content to disk without validating include paths, an authenticated user can create a project whose compose file declares include: ['../../../../etc/passwd'], then read the include via the project file API. The result is arbitrary read of any file readable by the Arcane backend process, including /app/data/arcane.db (the SQLite database containing every user's password hash and API key), enabling escalation to admin and, via Arcane's Docker control plane, RCE on the host. This vulnerability is fixed in 1.19.4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-29T17:06:34.169Z"}}}, "cveMetadata": {"cveId": "CVE-2026-47179", "state": "PUBLISHED", "dateUpdated": "2026-06-02T15:46:26.827Z", "dateReserved": "2026-05-18T21:25:34.498Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-29T17:06:34.169Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "arcane", "vendor": "getarcaneapp", "versions": [{"status": "affected", "version": "< 1.19.4"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.4, ProjectService.GetProjectFileContent returns the contents of any Docker Compose include directive declared in a project's compose file before any path-traversal validation runs. Because ProjectService.CreateProject writes attacker-supplied compose content to disk without validating include paths, an authenticated user can create a project whose compose file declares include: ['../../../../etc/passwd'], then read the include via the project file API. The result is arbitrary read of any file readable by the Arcane backend process, including /app/data/arcane.db (the SQLite database containing every user's password hash and API key), enabling escalation to admin and, via Arcane's Docker control plane, RCE on the host. This vulnerability is fixed in 1.19.4."}, {"lang": "es", "value": "Arcane es una interfaz para gestionar contenedores Docker, im\u00e1genes, redes y vol\u00famenes. Antes de la versi\u00f3n 1.19.4, ProjectService.GetProjectFileContent devuelve el contenido de cualquier directiva 'include' de Docker Compose declarada en el archivo compose de un proyecto antes de que se ejecute cualquier validaci\u00f3n de recorrido de ruta. Debido a que ProjectService.CreateProject escribe contenido compose suministrado por el atacante en el disco sin validar las rutas de 'include', un usuario autenticado puede crear un proyecto cuyo archivo compose declara 'include': ['.. / .. / .. / ../etc/pass1d'], luego leer el 'include' a trav\u00e9s de la API del archivo del proyecto. El resultado es la lectura arbitraria de cualquier archivo legible por el proceso backend de Arcane, incluyendo /app/data/arcane.db (la base de datos SQLite que contiene el hash de contrase\u00f1a y la clave API de cada usuario), lo que permite la escalada a administrador y, a trav\u00e9s del plano de control Docker de Arcane, RCE en el host. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 1.19.4."}], "id": "CVE-2026-47179", "lastModified": "2026-07-25T10:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47179", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-02T15:44:09.404804Z", "version": "2.0.3"}}]}, "published": "2026-05-29T18:17:12.500", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/getarcaneapp/arcane/commit/b6cbffabf61dbc3f12a28d3b5830e3c6b7e67daf"}, {"source": "security-advisories@github.com", "url": "https://github.com/getarcaneapp/arcane/security/advisories/GHSA-c3px-h233-h6fq"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.19.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "arcane", "source": "cna", "vendor": "getarcaneapp"}, "product": "arcane", "vendor": "getarcaneapp"}], "created": "2026-05-29T18:30:04.992772+00:00", "updated": "2026-05-29T18:30:05.346595+00:00", "vendors": ["getarcaneapp", "getarcaneapp$PRODUCT$arcane"]}