Path Traversal Vulnerability in Local Web Interface for Arc Process by Nozomi Networks
CVE-2026-33922
6.8MEDIUM
What is CVE-2026-33922?
A path traversal vulnerability affects the Offline archives functionality in the local web interface of the Arc Process. This issue arises from inadequate validation of input parameters, enabling a local user with administrative access to submit an archive name containing traversal sequences. This could allow for the deletion of arbitrary files that the Arc process, which has administrative privileges, can access on the host system. Proper validation and sanitization of user inputs are crucial to mitigate potential exploitation.
Affected Version(s)
Arc 0 < 2.7.0
References
CVSS V4
Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None
Timeline
Vulnerability published
Vulnerability Reserved
Credit
This issue was found by Andrea Palanca of Nozomi Networks Product Security team during an internal investigation.