CVE-2026-48105

Received Received - Intake

Path Traversal in Arc Enterprise Time-Series Database

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description

Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's Raft FSM (`internal/cluster/raft/fsm.go:applyRegisterFile`) accepts attacker-chosen file paths in manifest-registration proposals without validating them against the configured storage backend. The only check is that the path is non-empty. There is no parent-traversal (`..`) rejection, no allowlist of legitimate prefixes, no scheme restriction (`s3://` vs local), and no length bound. This is fixed in 2026.06.1. Some workarounds are available. Restrict cluster network access to known-trusted peers via strict firewall rules, audit the cluster manifest for unexpected paths (any path not matching the configured storage backend root is suspect), and/or disable cluster mode until the fix is available.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-21

Last Modified

2026-08-21

Generated

2026-08-22

AI Q&A

2026-08-22

EPSS Evaluated

N/A

NVD

CVE-2026-48105

Affected Vendors & Products

Vendor	Product	Version / Range
arc	arc	to 26.06.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-913	The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.
CWE-345	The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

Executive Summary

This vulnerability in Arc Enterprise before version 26.06.1 allows attackers to register files in arbitrary paths via the Raft FSM. The system does not validate file paths against the configured storage backend, enabling path traversal attacks. No checks exist for parent directories, allowlists, or path schemes, making it possible to write files outside intended locations.

Detection Guidance

Detecting this vulnerability requires checking Arc Enterprise's cluster manifest for unexpected file paths. Audit the manifest for any paths not matching the configured storage backend root. Use commands like grep or find to search for suspicious paths in manifest files. Ensure no parent-traversal (..) or non-standard schemes (e.g., s3://) are present.

Impact Analysis

An attacker could exploit this to overwrite critical files, escalate privileges, or execute arbitrary code by placing malicious files in sensitive directories. This could lead to data corruption, unauthorized access, or complete system compromise if combined with other vulnerabilities.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA due to unauthorized file path access in Arc Enterprise's Raft FSM. Attackers could exploit the lack of path validation to write files outside intended storage, risking data integrity and confidentiality. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. Unauthorized file access may lead to data breaches or unauthorized modifications, undermining compliance.

Mitigation Strategies

Immediately restrict cluster network access to trusted peers using strict firewall rules. Disable cluster mode if possible until upgrading to version 26.06.1 or later. Audit the cluster manifest for unexpected paths and remove any suspicious entries. Consider disabling cluster features if the fix cannot be applied promptly.

Hi! I’m here to help you understand CVE-2026-48105. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70