Path Traversal Vulnerability in Arcane Docker Management Tool

CVE-2026-47179

What is CVE-2026-47179?

Arcane, a tool designed for managing Docker containers, images, networks, and volumes, has a vulnerability where an authenticated user can exploit the ProjectService.GetProjectFileContent function. This function fails to validate paths before returning the contents of Docker Compose include directives from a project's compose file. By crafting a malicious compose file that includes sensitive paths (e.g., '../../../../etc/passwd'), an attacker can access files that the Arcane backend process can read, such as the SQLite database containing user password hashes and API keys. This flaw poses significant security risks, including potential privilege escalation and remote code execution on the underlying host through Arcane's Docker control plane. Users are advised to upgrade to version 1.19.4 to mitigate this risk.

References