CVE-2026-33922

MediumCVSS 6.0/10Last modified Oct 23, 2026

Description

A path traversal vulnerability was discovered in the Offline archives functionality of the local web interface due to insufficient validation of an input parameter. A local user with administrative credentials for the web interface could submit an archive name containing traversal sequences and delete arbitrary files reachable by the Arc process, which runs with administrative privileges on the host.

Metrics

CVSS 3.1 6.0/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Aug 11, 2026
Last modified: Oct 23, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-339294.3Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache PDFBox Examples. This issue affects CVE-2026-33937.8A security vulnerability has been detected in jarikomppa soloud up to 20200207. The impacted element is the function SoLoud::Wav::loadflac o CVE-2026-339305.9Apache Traffic Server copies the client Host header into a fixed-size stack buffer without a bound during redirect handling, so an over-long CVE-2026-339316.5OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, an Insecu CVE-2026-339325.4OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, a stored CVE-2026-339336.1OpenEMR is a free and open source electronic health records and medical practice management application. Starting in version 7.0.2.1 and pri CVE-2026-339344.3OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.3 have a mi CVE-2026-339357.5MyTube is a self-hosted downloader and player for several video websites Prior to version 1.8.72, an unauthenticated attacker can lock out a CVE-2026-339365.3The `ecdsa` PyPI package is a pure Python implementation of ECC (Elliptic Curve Cryptography) with support for ECDSA (Elliptic Curve Digital CVE-2026-339379.8Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handlebars.compile()` accep CVE-2026-339388.1Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the `@partial-block` special CVE-2026-339397.5Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, when a Handlebars template c