Vulnerability GO-2026-5308
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
3 months ago
June 25, 2026 at 06:43 PM UTC
Arcane Has an Authenticated Arbitrary Host File Read via Docker Compose Include Directives in github.com/getarcaneapp/arcane/backend
v1.15.3 - v1.19.3
v1.15.3 - v1.19.3
Summary
Arcane Has an Authenticated Arbitrary Host File Read via Docker Compose Include Directives in github.com/getarcaneapp/arcane/backend
Details
Arcane Has an Authenticated Arbitrary Host File Read via Docker Compose Include Directives in github.com/getarcaneapp/arcane/backend
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
6 hours ago
Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof` in github.com/getarcaneapp/arcane/backend
v1.15.3 - v1.20.0 GO-2026-6806
v1.15.3 - v1.20.0 GO-2026-6806
Unknown
6 hours ago
Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check) in github.com/getarcaneapp/arcane/backend
v1.15.3 - v1.20.0 GO-2026-6807
v1.15.3 - v1.20.0 GO-2026-6807
Unknown
3 months ago
Arcane Backend: Unauthenticated reflected XSS via SVG color parameter enables admin account takeover in github.com/getarcaneapp/arcane/backend
v1.15.3 - v1.18.1 GO-2026-5561
v1.15.3 - v1.18.1 GO-2026-5561
Unknown
3 months ago
Arcane: Missing admin authorization on global variables endpoint in github.com/getarcaneapp/arcane/backend
v1.15.3 - v1.19.1 GO-2026-5476
v1.15.3 - v1.19.1 GO-2026-5476
Unknown
3 months ago
Arcane Backend: OS Command Injection in Volume Browser ListDirectory via path query parameter in github.com/getarcaneapp/arcane/backend
v1.15.3 - v1.20.0 GO-2026-5292
v1.15.3 - v1.20.0 GO-2026-5292
Impacted packages
Timeline
Published
3 months ago
June 25, 2026 at 06:43 PM UTC
Fixed (v1.19.4)
5 months ago
May 18, 2026 at 01:31 AM UTC
Last Modified
3 months ago
June 25, 2026 at 07:45 PM UTC