NN-2026:15-01
Path traversal in the Offline archives functionality of the local web interface in Arc before v2.7.0
Last update: 2026-08-11
| Advisory ID | NN-2026:15-01 |
|---|---|
| Topic | Path traversal in the Offline archives functionality of the local web interface in Arc before v2.7.0 |
| CWE Impact | CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
| Issue date | 2026-08-11 |
| Affects | Arc < v2.7.0 |
| CVE Name(s) | CVE-2026-33922 |
| CVSS Details | CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H |
| CVSS Score | 6.8 (CVSS v4.0) 6.0 (CVSS v3.1) |
| CVE Risk Level | Medium (CVSS v4.0) Medium (CVSS v3.1) |
| Risk Level for Nozomi customers | Medium |
Summary
A path traversal vulnerability was discovered in the Offline archives functionality of the local web interface due to insufficient validation of an input parameter.
Impact
A local user with administrative credentials for the web interface could submit an archive name containing traversal sequences and delete arbitrary files reachable by the Arc process, which runs with administrative privileges on the host.
Affected Products
Arc < v2.7.0
Workarounds and Mitigations
Review the credentials of the web interface and rotate them by relaunching Arc's local web server if they may have been exposed to untrusted users.
Solutions
Upgrade Arc to v2.7.0 or later.
Modification History
2026-08-11: Initial revision
Related Links
Acknowledgements
We thank the following parties for their efforts:
- Andrea Palanca of Nozomi Networks Product Security team for finding this issue during an internal investigation
Contact
Nozomi Networks Product Security team can be reached at prodsec@nozominetworks.com.More contact details on the PSIRT page.