https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 13:50:29 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-323618 EUVD-2026-323618 https://cve.radiocsirt.org/vuln/euvd-2026-323618 https://cve.radiocsirt.org/vuln/fkie_cve-2026-45626 <p>Arcane is an interface for managing Docker containers, images, networks, and volumes. In 1.18.1 and earlier, GET /environments/{id}/volumes/{volumeName}/browse accepts a path query parameter that is passed to a shell command (sh -c &#34;find … | while …&#34;) inside an Arcane helper container. The path sanitiser blocks ../ traversal but does not strip Bourne-shell metacharacters such as $() or backticks, and strconv.Quote only escapes Go string metacharacters, not shell substitution sequences. Any authenticated user with access to a browseable volume can execute arbitrary commands inside the helper container; command output is reflected back in the 500 error body.</p> <p>Arcane is an interface for managing Docker containers, images, networks, and volumes. In 1.18.1 and earlier, GET /environments/{id}/volumes/{volumeName}/browse accepts a path query parameter that is passed to a shell command (sh -c &#34;find … | while …&#34;) inside an Arcane helper container. The path sanitiser blocks ../ traversal but does not strip Bourne-shell metacharacters such as $() or backticks, and strconv.Quote only escapes Go string metacharacters, not shell substitution sequences. Any authenticated user with access to a browseable volume can execute arbitrary commands inside the helper container; command output is reflected back in the 500 error body.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-45626 https://cve.radiocsirt.org/vuln/ghsa-9mvm-4gwg-v8mp <p><strong>Affected:</strong> Go: github.com/getarcaneapp/arcane/backend</p> <p>## Summary</p> <p>`GET /environments/{id}/volumes/{volumeName}/browse` accepts a `path` query parameter that is passed to a shell command (`sh -c &#34;find … | while …&#34;`) inside an Arcane helper container. The path sanitiser blocks `../` traversal but does not strip Bourne-shell metacharacters such as `$()` or backticks, and `strconv.Quote` only escapes Go string metacharacters, not shell substitution sequences. Any authenticated user with access to a browseable volume can execute arbitrary commands inside the helper container; command output is reflected back in the 500 error body.</p> <p>## Details</p> <p>The execution flow is:</p> <p>1. `BrowseDirectoryInput.Path` (query: `path`) — `backend/internal/huma/handlers/volumes.go:148` 2. `VolumeHandler.BrowseDirectory` calls `volumeService.ListDirectory(ctx, volumeName, input.Path)` — `backend/internal/huma/handlers/volumes.go:858-865`. Note the route registration at line 412–419 only declares `BearerAuth`/`ApiKeyAuth`; there is no `checkAdmin(ctx)` call (compare with `customize.go`, `system.go`, `swarm.go`, etc., which do enforce admin). 3. `VolumeService.ListDirectory` runs the user-supplied path through `sanitizeBrowsePathInternal`, then joins it under `/volume`, quotes it with `strconv.Quote`, and embeds it into a `sh -c` command:</p> <p>```go // backend/internal/services/volume_service.go:286-300 sanitizedPath, err := s.sanitizeBrowsePathInternal(dirPath) ... targetPath := path.Join(&#34;/volume&#34;, sanitizedPath) quotedPath := strconv.Quote(targetPath) cmd := […</p> <p><strong>Affected:</strong> Go: github.com/getarcaneapp/arcane/backend</p> <p>## Summary</p> <p>`GET /environments/{id}/volumes/{volumeName}/browse` accepts a `path` query parameter that is passed to a shell command (`sh -c &#34;find … | while …&#34;`) inside an Arcane helper container. The path sanitiser blocks `../` traversal but does not strip Bourne-shell metacharacters such as `$()` or backticks, and `strconv.Quote` only escapes Go string metacharacters, not shell substitution sequences. Any authenticated user with access to a browseable volume can execute arbitrary commands inside the helper container; command output is reflected back in the 500 error body.</p> <p>## Details</p> <p>The execution flow is:</p> <p>1. `BrowseDirectoryInput.Path` (query: `path`) — `backend/internal/huma/handlers/volumes.go:148` 2. `VolumeHandler.BrowseDirectory` calls `volumeService.ListDirectory(ctx, volumeName, input.Path)` — `backend/internal/huma/handlers/volumes.go:858-865`. Note the route registration at line 412–419 only declares `BearerAuth`/`ApiKeyAuth`; there is no `checkAdmin(ctx)` call (compare with `customize.go`, `system.go`, `swarm.go`, etc., which do enforce admin). 3. `VolumeService.ListDirectory` runs the user-supplied path through `sanitizeBrowsePathInternal`, then joins it under `/volume`, quotes it with `strconv.Quote`, and embeds it into a `sh -c` command:</p> <p>```go // backend/internal/services/volume_service.go:286-300 sanitizedPath, err := s.sanitizeBrowsePathInternal(dirPath) ... targetPath := path.Join(&#34;/volume&#34;, sanitizedPath) quotedPath := strconv.Quote(targetPath) cmd := […</p> https://cve.radiocsirt.org/vuln/ghsa-9mvm-4gwg-v8mp