Executive Summary

CVE-2026-45626 is an OS Command Injection vulnerability in the Arcane application's Volume Browser ListDirectory functionality. It occurs because the 'path' query parameter in the GET /environments/{id}/volumes/{volumeName}/browse endpoint is passed directly to a shell command inside an Arcane helper container without proper sanitization.

Although the path sanitizer blocks directory traversal sequences like "../", it does not remove Bourne-shell metacharacters such as $(), backticks, ;, &, |, or >. Additionally, the strconv.Quote function only escapes Go string metacharacters and does not prevent shell substitution sequences, allowing an attacker to inject arbitrary shell commands.

Any authenticated user with access to a browseable volume can exploit this to execute arbitrary commands inside the helper container. The output of these commands is reflected back in HTTP 500 error responses.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an authenticated user to execute arbitrary commands inside the Arcane helper container, potentially leading to unauthorized actions within that container.

Although the helper container is isolated with network disabled, no privileged mode, and read-only volume mounts, limiting the impact, attackers can bypass API restrictions such as symlink censorship and file size limits.

Attackers can also exfiltrate data via error messages returned by the server. Additionally, a secondary issue allows a destructive command (rm -rf /volume) to be triggered via the DELETE endpoint with a specific path parameter.

Overall, the vulnerability has moderate severity (CVSS 6.3) and can impact confidentiality, integrity, and availability within the scope of the helper container.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to exploit the command injection via the GET /environments/{id}/volumes/{volumeName}/browse endpoint with crafted path query parameters containing Bourne-shell metacharacters such as $() or backticks.

If the system is vulnerable, executing such requests as an authenticated user may cause the helper container to execute arbitrary commands, with the command output reflected in HTTP 500 error responses.

A detection approach could involve sending a request with a path parameter designed to execute a harmless command, for example:

• curl -i -H "Authorization: Bearer <token>" "https://<arcane-host>/environments/<id>/volumes/<volumeName>/browse?path=$(id)"

If the response contains output from the 'id' command inside the error body, it indicates the vulnerability is present.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading Arcane to a version later than 1.18.1 where this vulnerability is fixed.

If upgrading is not immediately possible, restrict access to the Arcane API to trusted users only, as the vulnerability requires authenticated access.

Additionally, monitor and audit API usage for suspicious requests containing shell metacharacters in the path parameter.

Consider disabling or limiting the use of the Volume Browser functionality until a patch is applied.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows authenticated users to execute arbitrary commands inside an isolated helper container, potentially leading to limited confidentiality, integrity, and availability impacts within that container. However, due to the container's isolation and limited blast radius, the overall impact on sensitive data or systems is constrained.

There is no explicit information provided about direct effects on compliance with common standards and regulations such as GDPR or HIPAA. The limited scope and containment of the vulnerability suggest that while there is a risk of data exfiltration via error messages, the impact on regulated data environments is not detailed.

Therefore, without further details on the nature of data handled or additional context on regulatory environments, the compliance impact cannot be definitively assessed from the provided information.

Useful 0 Not Useful 0