https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 12:50:24 +0000 https://cve.radiocsirt.org/vuln/cve-2026-47179 <p><strong>Affected:</strong> getarcaneapp arcane</p> <p>Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.4, ProjectService.GetProjectFileContent returns the contents of any Docker Compose include directive declared in a project&#39;s compose file before any path-traversal validation runs. Because ProjectService.CreateProject writes attacker-supplied compose content to disk without validating include paths, an authenticated user can create a project whose compose file declares include: [&#39;../../../../etc/passwd&#39;], then read the include via the project file API. The result is arbitrary read of any file readable by the Arcane backend process, including /app/data/arcane.db (the SQLite database containing every user&#39;s password hash and API key), enabling escalation to admin and, via Arcane&#39;s Docker control plane, RCE on the host. This vulnerability is fixed in 1.19.4.</p> <p><strong>Affected:</strong> getarcaneapp arcane</p> <p>Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.4, ProjectService.GetProjectFileContent returns the contents of any Docker Compose include directive declared in a project&#39;s compose file before any path-traversal validation runs. Because ProjectService.CreateProject writes attacker-supplied compose content to disk without validating include paths, an authenticated user can create a project whose compose file declares include: [&#39;../../../../etc/passwd&#39;], then read the include via the project file API. The result is arbitrary read of any file readable by the Arcane backend process, including /app/data/arcane.db (the SQLite database containing every user&#39;s password hash and API key), enabling escalation to admin and, via Arcane&#39;s Docker control plane, RCE on the host. This vulnerability is fixed in 1.19.4.</p> https://cve.radiocsirt.org/vuln/cve-2026-47179