# Arcane Has an Authenticated Arbitrary Host File Read via Docker Compose Include Directives

Arcane's CreateProject skips include-path validation and GetProjectFileContent returns include file contents pre-validation, letting any authenticated user read arbitrary host files like arcane.db.

- Payout: Research
- Severity: high
- Program: Arcane
- Found by: offset
- Disclosed: 2026-05-28
- CVE: CVE-2026-47179
- Write-up quality: 8/10
- Original: https://github.com/advisories/GHSA-c3px-h233-h6fq
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-c3px-h233-h6fq
- Tags: area:cloud domain:infra domain:web impact:data-leak impact:privesc impact:rce kind:research platform:ghsa sev:high tech:docker tech:go technique:chained technique:source-review vuln:access-control vuln:path-traversal

**Target:** Docker Compose project file API (Go backend)
**Root cause:** CreateProject writes attacker-supplied compose content to disk without calling validateComposeContentForUpdate, so malicious include paths survive; GetProjectFileContent then matches and returns include file contents before the IsSafeSubdirectory check runs, and ParseIncludes reads include paths from anywhere by design.
**Steps:**
1. Authenticate as a low-privilege `"user"` role and obtain a Bearer token or API key.
2. `POST /api/environments/{id}/projects` with compose content declaring `include: ['../../../../etc/passwd']` (or `/app/data/arcane.db`).
3. `GET /api/environments/{id}/projects/{projectId}/file` with `relativePath` equal to the include path `../../../../etc/passwd`.
4. Response returns the raw file content from the IncludeFile branch before the IsSafeSubdirectory check.
**How found:** Code review comparing CreateProject against UpdateProject: noticed UpdateProject calls validateComposeContentForUpdate (which invokes ValidateIncludePathForWrite) while CreateProject does not, then traced GetProjectFileContent and saw the include-match return precedes the IsSafeSubdirectory check.
**Exploitation:** Any authenticated user creates a project with a compose file containing an include directive pointing outside the project directory; the create path skips the write-side validator, and the file-read endpoint returns the include's content verbatim. Reading `/app/data/arcane.db` yields argon2 password hashes and API keys for all users including admins, enabling credential recovery/replay and, with the Docker socket mounted, host RCE.
**Escalation:** Read arcane.db to recover admin hashes/API keys, then use admin-level Arcane Docker control (container/exec/volume) to reach host RCE.
**Insight:** When a codebase documents an intentional read-anywhere policy for a feature (compose includes), check every write path that feeds it for the missing validator — here the update path validated includes but the create path didn't, and the read path trusted the stored include path before containment checks.