Remote Code Execution in Arcane Docker Management Interface

CVE-2026-45627

What is CVE-2026-45627?

The Arcane Docker management interface prior to version 1.19.0 is vulnerable to a remote code execution vulnerability. An unauthenticated GET request to the /api/app-images/logo endpoint allows an attacker to exploit a reflected user-supplied color query parameter directly into the SVG content. This flaw takes advantage of an unescaped substitution within a element, enabling the injection of executable content. Since the response is served as image/svg+xml, and there are no protective headers like Content-Security-Policy or X-Content-Type-Options in place, attackers can manipulate the URL to execute arbitrary JavaScript in the context of the logged-in admin's session. This can lead to a complete compromise of the admin account, including unauthorized access to sensitive data. The issue has been addressed in version 1.19.0, reinforcing the need for immediate updates.

References