A high-severity vulnerability in the Basekick-Labs arc database allows authenticated attackers to perform path traversal and server-side request forgery, potentially leading to unauthorized data access.

This vulnerability involves multiple weaknesses, including path traversal (CWE-22), sensitive information exposure (CWE-200), and server-side request forgery (CWE-918). The attack vector requires a low-privileged authenticated user to interact with the system to trigger these flaws.

Successful exploitation of these vulnerabilities could allow an attacker to read sensitive files outside of the intended directory, access unauthorized internal resources, or potentially pivot into the internal network via SSRF. Given the CVSS score of 7.1, this represents a significant risk to the confidentiality of telemetry data stored within the database.

Immediate Action: Update the arc database installation to version 2026.06.1 or later as specified in the vendor security advisory.

Proactive Monitoring: Monitor database access logs for unusual directory traversal patterns or unexpected outbound network requests originating from the database host.

Compensating Controls: Implement strict network egress filtering on the database server to prevent unauthorized internal resource access via SSRF.

Public Exploit Available: Unknown

The vulnerabilities identified in arc pose a substantial risk to data integrity and network security. Administrators should prioritize the deployment of the provided security update immediately to eliminate the underlying path traversal and SSRF vectors.