EUVD-2026-64192Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable via cluster protocol requiring low-privilege peer access; scope change applies because writes escape the storage backend boundary into external filesystem or cloud storage space; no confidentiality or availability impact observed.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's Raft FSM (internal/cluster/raft/fsm.go:applyRegisterFile) accepts attacker-chosen file paths in manifest-registration proposals without validating them against the configured storage backend. The only check is that the path is non-empty. There is no parent-traversal (..) rejection, no allowlist of legitimate prefixes, no scheme restriction (s3:// vs local), and no length bound. This is fixed in 2026.06.1. Some workarounds are available. Restrict cluster network access to known-trusted peers via strict firewall rules, audit the cluster manifest for unexpected paths (any path not matching the configured storage backend root is suspect), and/or disable cluster mode until the fix is available.
AnalysisAI
Path traversal in Arc Enterprise's Raft finite state machine allows low-privileged cluster peers to register arbitrary file paths via manifest-registration proposals, bypassing all path validation in the applyRegisterFile handler (internal/cluster/raft/fsm.go). All Arc Enterprise deployments running in cluster mode prior to version 2026.06.1 are affected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires Arc Enterprise to be deployed and actively running in cluster mode - the vulnerability exists solely in the Raft consensus subsystem and standalone Arc deployments are not affected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.3 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N) reflects a network-reachable, low-complexity flaw requiring low privileges with no user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Arc version 2026.06.1 or later, which introduces proper path validation in the Raft FSM manifest-registration handler; this is the primary fix confirmed by the vendor advisory at https://github.com/Basekick-Labs/arc/security/advisories/GHSA-f85q-mvg8-qf37. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Arc Enterprise deployments operating in cluster mode and identify systems running versions prior to 2026.06.1, prioritizing production environments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
CData RSB Connect v22.0.8336 was discovered to contain a Server-Side Request Forgery (SSRF). Rated high severity (CVSS 7
Arc before 1.26.1 on Windows has a bypass issue in the site settings that allows websites (with previously granted permi
Missing application-layer authentication in Arc Enterprise's cluster replication receiver (prior to version 2026.06.1) a
Path traversal in Nozomi Networks Arc's local web interface allows a local administrator to delete arbitrary files on th
The server certificate was not verified when an Arc agent connected to a Guardian or CMC. A malicious actor could perfor
Nozomi Networks Arc for Windows installs the Npcap packet capture driver with its access restriction option left at the
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today