CVE-2026-47179: Arcane Path-Traversal in Docker Compose Include Directives

Technical summary

CVE-2026-47179 stems from improper input validation in Arcane's ProjectService class. The vulnerability has two contributing factors: (1) ProjectService.CreateProject accepts and writes attacker-supplied Docker Compose content to disk without sanitizing include directive paths, and (2) ProjectService.GetProjectFileContent processes include directives before path-traversal validation occurs. This ordering flaw means an authenticated user can include a malicious include directive (e.g., include: ['../../../../etc/passwd']) in their project's compose file, which is persisted to disk and later resolved by the API endpoint without proper canonicalization or boundary checks. The attacker then retrieves file contents through the same API endpoint. The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), scored CVSS 3.1 at 7.7 (HIGH severity).

Business impact

Organizations using Arcane face significant risk of credential compromise and lateral movement. An attacker with valid Arcane credentials—or an insider—can extract the entire user database containing password hashes and API keys, effectively compromising every Arcane user account. Escalation to administrative access then enables full control over Docker infrastructure managed through Arcane, potentially leading to workload exfiltration, data destruction, or deployment of malicious containers across the environment. In multi-tenant or shared-infrastructure scenarios, this represents a blast radius extending to all hosted services.

Affected systems

Arcane versions prior to 1.19.4 are affected. The vulnerability requires authentication to exploit, so only instances with user accounts or API key access are at active risk. Verify your installed version against the vendor advisory to confirm whether you are running a vulnerable release.

Exploitability

Exploitation requires valid authentication credentials to the Arcane instance. An attacker cannot exploit this vulnerability remotely without first obtaining legitimate user access. However, the attack is trivial once authenticated: it requires only crafting a compose file with a path-traversal include directive and using standard Arcane APIs to create a project and retrieve file contents. No special tooling, race conditions, or user interaction is required. The severity is further elevated because Arcane's database—containing credentials for the entire user base—is readable by the backend process, making it a high-value target.

Remediation

Upgrade Arcane to version 1.19.4 or later immediately. The patch implements proper validation of include directive paths before processing, ensuring that includes cannot traverse outside their intended project directory. Organizations should treat this as a priority remediation given the direct path to credential compromise and infrastructure control. After patching, review access logs and audit trails to detect whether this vulnerability was exploited in your environment.

Patch guidance

Consult the official Arcane release notes and security advisories for version 1.19.4 to confirm patch applicability and any prerequisite configuration changes. Test the upgrade in a non-production environment first, as container management tools often require careful orchestration during updates. Verify that compose file validation is functioning correctly post-patch by confirming that include directives are now restricted to safe paths. If you are currently on a version between the initial release and 1.19.4, plan your upgrade path accordingly and prioritize rapid deployment.

Detection guidance

Monitor Arcane audit logs for suspicious project creation events, particularly those involving compose files with include directives pointing to system directories (e.g., ../, etc/, app/). Search for API calls to GetProjectFileContent that occur shortly after project creation with non-standard file paths. Review recently created projects and their compose file contents for path-traversal patterns. Check Arcane database access logs and file-system activity logs for reads of /app/data/arcane.db or similar sensitive files. Correlation of these indicators may reveal past exploitation attempts.

Why prioritize this

This vulnerability merits immediate attention because: (1) it enables unauthenticated attackers to assume any user identity via credential theft, (2) it provides direct access to the Arcane database containing all user secrets, (3) it leads to complete compromise of Docker infrastructure, and (4) a patch is available and should be deployed without delay. The attack is simple, the impact is severe, and the remediation is straightforward.

Risk score, explained

The CVSS 3.1 score of 7.7 (HIGH) reflects a network-accessible vulnerability requiring low privileges (authentication) with low attack complexity. The attack vector is network-based, no user interaction is needed, and the scope changes because compromise of Arcane enables control over the entire Docker environment. Confidentiality impact is high due to unrestricted file read access; integrity and availability impacts are not directly rated by CVSS but are substantial given the ability to escalate to admin and execute code on the host.

Frequently asked questions