CVE-2026-45626

Arcane is an interface for managing Docker containers, images, networks, and volumes. In 1.18.1 and earlier, GET /environments/{id}/volumes/{volumeName}/browse accepts a path query parameter that is passed to a shell command (sh -c "find … | while …") inside an Arcane helper container. The path sanitiser blocks ../ traversal but does not strip Bourne-shell metacharacters such as $() or backticks, and strconv.Quote only escapes Go string metacharacters, not shell substitution sequences. Any authenticated user with access to a browseable volume can execute arbitrary commands inside the helper container; command output is reflected back in the 500 error body.

• CWE-78

• https://github.com/getarcaneapp/arcane/security/advisories/GHSA-9mvm-4gwg-v8mp

Published

May 29, 2026

Last Modified

Jul 21, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4562A security flaw has been discovered in MacCMS 2025.1000.4052…7.3
• CVE-2026-45620WWBN AVideo is an open source video platform. In 29.0 and ea…5.3
• CVE-2026-45622Vvveb is a powerful and easy to use CMS with page builder to…5.3
• CVE-2026-45623PostCSS takes a CSS file and provides an API to analyze and …9.1
• CVE-2026-45624ImageMagick is free and open-source software used for editin…5.1
• CVE-2026-45625Arcane is an interface for managing Docker containers, image…9.9
• CVE-2026-45627Arcane is an interface for managing Docker containers, image…8.2
• CVE-2026-45628Dokploy is a free, self-hostable Platform as a Service (PaaS…9.6
• CVE-2026-45629Dokploy is a free, self-hostable Platform as a Service (PaaS…9.9
• CVE-2026-4563A weakness has been identified in MacCMS up to 2025.1000.405…4.3
• CVE-2026-45630Dokploy is a free, self-hostable Platform as a Service (PaaS…9
• CVE-2026-45631Dokploy is a free, self-hostable Platform as a Service (PaaS…10