PT-2026-41693 · Arcane · Arcane
CVSS v3.1
6.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
Arcane versions prior to 1.18.2
Description
Arcane is an interface for managing Docker containers, images, networks, and volumes. An issue exists where the endpoint "GET /environments/{id}/volumes/{volumeName}/browse" accepts a
path query parameter that is passed to a shell command (sh -c "find … | while …") inside an Arcane helper container. While the path sanitiser prevents directory traversal using ../, it fails to strip Bourne-shell metacharacters such as $() or backticks. Additionally, the use of strconv.Quote only escapes Go string metacharacters and not shell substitution sequences.This allows any authenticated user with access to a browseable volume to execute arbitrary commands within the helper container. The output of these commands is reflected back to the user in the HTTP 500 error body, which can be used as an exfiltration channel. This capability allows attackers to bypass API restrictions, such as symlink-target censoring and per-file byte limits. Furthermore, a separate logic flaw in the same sanitiser allows authenticated users to recursively delete all volume contents by sending
path=. to the "DELETE /environments/{id}/volumes/{volumeName}/browse" endpoint.Recommendations
Update Arcane to version 1.18.2 or later.
As a temporary mitigation, restrict access to the "GET /environments/{id}/volumes/{volumeName}/browse" and "DELETE /environments/{id}/volumes/{volumeName}/browse" endpoints to only trusted administrative users.
Exploit
Fix
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Arcane