CVE-2026-48105

Katalog CVE

CVSS 8.3 · High EPSS 0,22%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). Skor CVSS 4.0 8.3 (High) menurut github.com.

Deskripsi (NVD)

Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's Raft FSM (`internal/cluster/raft/fsm.go:applyRegisterFile`) accepts attacker-chosen file paths in manifest-registration proposals without validating them against the configured storage backend. The only check is that the path is non-empty. There is no parent-traversal (`..`) rejection, no allowlist of legitimate prefixes, no scheme restriction (`s3://` vs local), and no length bound. This is fixed in 2026.06.1. Some workarounds are available. Restrict cluster network access to known-trusted peers via strict firewall rules, audit the cluster manifest for unexpected paths (any path not matching the configured storage backend root is suspect), and/or disable cluster mode until the fix is available.

Rincian

Terbit di NVD

21 Agustus 2026

Terakhir diubah

12 Oktober 2026

Status NVD

Deferred

CVSS 4.0

8.3 (High), sumber github.com
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-345: Insufficient Verification of Data Authenticity
CWE-913: Improper Control of Dynamically-Managed Code Resources

EPSS (30 hari)

0,22% peluang dieksploitasi; lebih tinggi dari 12,0% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/Basekick-Labs/arc/security/advisories/GHSA-f85q-mvg8-qf37