Vulnerability GO-2026-5292
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
3 months ago
June 25, 2026 at 06:43 PM UTC
Arcane Backend: OS Command Injection in Volume Browser ListDirectory via path query parameter in github.com/getarcaneapp/arcane/backend
v1.15.3 - v1.20.0
v1.15.3 - v1.20.0
Summary
Arcane Backend: OS Command Injection in Volume Browser ListDirectory via path query parameter in github.com/getarcaneapp/arcane/backend
Details
Arcane Backend: OS Command Injection in Volume Browser ListDirectory via path query parameter in github.com/getarcaneapp/arcane/backend
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
6 hours ago
Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof` in github.com/getarcaneapp/arcane/backend
v1.15.3 - v1.20.0 GO-2026-6806
v1.15.3 - v1.20.0 GO-2026-6806
Unknown
6 hours ago
Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check) in github.com/getarcaneapp/arcane/backend
v1.15.3 - v1.20.0 GO-2026-6807
v1.15.3 - v1.20.0 GO-2026-6807
Unknown
3 months ago
Arcane Backend: Unauthenticated reflected XSS via SVG color parameter enables admin account takeover in github.com/getarcaneapp/arcane/backend
v1.15.3 - v1.18.1 GO-2026-5561
v1.15.3 - v1.18.1 GO-2026-5561
Unknown
3 months ago
Arcane: Missing admin authorization on global variables endpoint in github.com/getarcaneapp/arcane/backend
v1.15.3 - v1.19.1 GO-2026-5476
v1.15.3 - v1.19.1 GO-2026-5476
Unknown
3 months ago
Arcane Has an Authenticated Arbitrary Host File Read via Docker Compose Include Directives in github.com/getarcaneapp/arcane/backend
v1.15.3 - v1.19.3 GO-2026-5308
v1.15.3 - v1.19.3 GO-2026-5308
Impacted packages
Timeline
Published
3 months ago
June 25, 2026 at 06:43 PM UTC
Last Modified
3 months ago
June 25, 2026 at 07:45 PM UTC