« Volver al listado

CVE-2026-45626

Estado: AplazadaMedia (6.3)—

Arcane is an interface for managing Docker containers, images, networks, and volumes. In 1.18.1 and earlier, GET /environments/{id}/volumes/{volumeName}/browse accepts a path query parameter that is passed to a shell command (sh -c "find … | while …") inside an Arcane helper container. The path sanitiser blocks ../ traversal but does not strip Bourne-shell metacharacters such as $() or backticks, and strconv.Quote only escapes Go string metacharacters, not shell substitution sequences. Any authenticated user with access to a browseable volume can execute arbitrary commands inside the helper container; command output is reflected back in the 500 error body.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Arcane — ArcaneAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-45626",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-45626",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-01T22:34:59.747576Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "getarcaneapp",
          "product": "arcane",
          "versions": [
            {
              "status": "affected",
              "version": "<= 1.18.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-05-29T18:17:10.483",
  "references": [
    {
      "url": "https://github.com/getarcaneapp/arcane/security/advisories/GHSA-9mvm-4gwg-v8mp",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Arcane is an interface for managing Docker containers, images, networks, and volumes. In 1.18.1 and earlier, GET /environments/{id}/volumes/{volumeName}/browse accepts a path query parameter that is passed to a shell command (sh -c \"find … | while …\") inside an Arcane helper container. The path sanitiser blocks ../ traversal but does not strip Bourne-shell metacharacters such as $() or backticks, and strconv.Quote only escapes Go string metacharacters, not shell substitution sequences. Any authenticated user with access to a browseable volume can execute arbitrary commands inside the helper container; command output is reflected back in the 500 error body."
    },
    {
      "lang": "es",
      "value": "Arcane es una interfaz para gestionar contenedores Docker, imágenes, redes y volúmenes. En 1.18.1 y versiones anteriores, GET /environments/{id}/volumes/{volumeName}/browse acepta un parámetro de consulta de ruta que se pasa a un comando de shell (sh -c 'find … | while …') dentro de un contenedor auxiliar de Arcane. El saneador de rutas bloquea el recorrido ../ pero no elimina los metacaracteres de Bourne-shell como $() o las comillas invertidas, y strconv.Quote solo escapa los metacaracteres de cadena de Go, no las secuencias de sustitución de shell. Cualquier usuario autenticado con acceso a un volumen navegable puede ejecutar comandos arbitrarios dentro del contenedor auxiliar; la salida del comando se refleja en el cuerpo del error 500."
    }
  ],
  "lastModified": "2026-07-21T15:10:00.103",
  "sourceIdentifier": "security-advisories@github.com"
}