Description

A path traversal vulnerability was discovered in the Offline archives functionality of the local web interface due to insufficient validation of an input parameter. A local user with administrative credentials for the web interface could submit an archive name containing traversal sequences and delete arbitrary files reachable by the Arc process, which runs with administrative privileges on the host.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.0",
  "pubDate": "2026-08-11T10:17:12.257Z",
  "pubdate": "2026-08-11T10:17:12.257Z",
  "executiveSummary": "A path traversal vulnerability has been identified within the Offline archives functionality of the local web interface.\nThe vulnerability arises due to insufficient validation of an input parameter associated with archive names.\nA local authenticated user possessing administrative credentials for the web interface can exploit this flaw by submitting a crafted archive name containing directory traversal sequences.\nSuccessful exploitation allows the deletion of arbitrary files accessible to the Arc process.\nThe severity of this issue is heightened because the Arc process operates with administrative privileges on the underlying host system, granting broad file system access within the context of the service account.\nThe primary risk implication is the potential for unauthorized deletion of critical system or application files, leading to denial of service or instability.\nThe attack requires prior administrative authentication to the local web interface and local access capabilities.",
  "technicalDetails": "The vulnerability is rooted in inadequate input sanitization and validation within the Offline archives component of the local web interface.\nWhen processing requests related to offline archives, the application fails to properly filter or neutralize path traversal sequences (such as dot-dot-slash patterns) embedded within the archive name input parameter.\nThe vulnerable component is tied to the archive management functions exposed by the local web interface, which interfaces directly with the backend Arc process.\nThe exploitation method involves an authenticated administrator supplying a maliciously crafted archive name containing traversal sequences to the vulnerable parameter.\nThe attack flow proceeds as follows: First, the attacker authenticates to the local web interface using administrative credentials. Second, the attacker initiates a request involving the Offline archives functionality, injecting path traversal sequences into the archive name parameter. Third, the input is processed by the application without adequate validation, allowing the traversal sequences to manipulate the target file path. Finally, the operation interacts with the file system, resolving the manipulated path outside the intended directory scope.\nBecause the Arc process executes with administrative privileges on the host, the operation executes with elevated permissions.\nThe post-exploitation impact includes the arbitrary deletion of files reachable by the Arc process, potentially compromising the integrity and operational availability of the host environment or dependent services.\nNetwork exposure is restricted to the local web interface, and exploitation strictly requires administrative-level authentication and local or interface-level access."
}