An authenticated user can create a project in Arcane that includes a Docker Compose file containing the directive include:['../../../../etc/passwd']. The ProjectService.GetProjectFileContent method returns the contents of these include files before performing any path‑traversal validation, allowing the attacker to read arbitrary files that are readable by the Arcane backend process. The user can access sensitive files such as /app/data/arcane.db, which stores user password hashes and API keys, and can also read other system files. This data breach could be leveraged for privilege escalation and remote code execution on the host via Arcane's Docker control plane.

Arcane (getarcaneapp:arcane) software versions prior to 1.19.4 are vulnerable. Version 1.19.4 and later contain the fix that validates include paths before reading the file.

The CVSS score of 7.7 indicates high severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector requires authentication to create a project. Once authenticated, an attacker can choose arbitrary include paths, read any file accessible to the backend process, and potentially elevate privileges or execute code on the host. The risk is substantial for systems where Arcane is exposed to untrusted users.