CVE-2026-45626 Arcane: OS Command Injection in Volume Browser ListDirectory via path query parameter
Authenticated users can execute arbitrary shell commands in the helper container via the volume browser path parameter due to insufficient input sanitization.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-45626?
CVE-2026-45626 is a medium-severity command injection vulnerability in getarcaneapp arcane, published on 29 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Arcane is an interface for managing Docker containers, images, networks, and volumes. In 1.18.1 and earlier, GET /environments/{id}/volumes/{volumeName}/browse accepts a path query parameter that is passed to a shell command (sh -c "find … | while …") inside an Arcane helper container. The path sanitiser blocks ../ traversal but does not strip Bourne-shell metacharacters such as $() or backticks, and strconv.Quote only escapes Go string metacharacters, not shell substitution sequences. Any authenticated user with access to a browseable volume can execute arbitrary commands inside the helper container; command output is reflected back in the 500 error body.
Weakness: CWE-78
Which versions are affected by CVE-2026-45626?
3 open source packages ship an affected version, including github.com/getarcaneapp/arcane/backend.
| Package | Affected | Fixed in |
|---|---|---|
github.com/getarcaneapp/arcane/backend Go | All versions | None |
github.com/getarcaneapp/arcane/backend Go | All versions to 1.18.1 | None |
github.com/getarcaneapp/arcane/backend Go | All versions to 1.18.1 | None |
How do I fix CVE-2026-45626?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-45626 being exploited?
There is no known exploitation of CVE-2026-45626 in the wild and no public exploit code.
Sources
Also known as GHSA-9mvm-4gwg-v8mp, GO-2026-5292.