Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.4, ProjectService.GetProjectFileContent returns the contents of any Docker Compose include directive declared in a project's compose file before any path-traversal validation runs. Because ProjectService.CreateProject writes attacker-supplied compose content to disk without validating include paths, an authenticated user can create a project whose compose file declares include: ['../../../../etc/passwd'], then read the include via the project file API. The result is arbitrary read of any file readable by the Arcane backend process, including /app/data/arcane.db (the SQLite database containing every user's password hash and API key), enabling escalation to admin and, via Arcane's Docker control plane, RCE on the host. This vulnerability is fixed in 1.19.4.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-47179 Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.4, ProjectService.GetProjectFileContent returns the contents of an… https://www.cve.org/CVERecord?id=CVE-2026-47179
Post summary
The text merely references CVE-2026‑47179 and a brief description of the affected component, without providing evidence of exploitation, patch status, or detailed technical information.
🚨*CVE* CVE-2026-47179 Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.4, ProjectService.GetProjectFileContent returns the contents of an… https://www.cve.org/CVERecord?id=CVE-2026-47179 ----- Traducción: CVE-2026-47179 Arc… http://infoflow.cloud`
Post summary
The post simply announces CVE-2026-47179 for Arcane’s Docker management interface, noting a pre‑1.19.4 issue with ProjectService.GetProjectFileContent, and links to a CVE record for more details.