Authenticated attackers can exploit path traversal and data integrity flaws in the Basekick-Labs arc database to manipulate system files and execute unauthorized actions.

The software suffers from path traversal (CWE-22) and insufficient verification of data authenticity (CWE-345), which can be abused to manage code resources improperly (CWE-913). This vulnerability requires the attacker to have at least low-privileged access to the system.

Successful exploitation permits an authenticated attacker to perform path traversal, potentially leading to unauthorized data modification or system integrity compromise. With a CVSS score of 8.3, the vulnerability poses a high risk to the overall stability and security of the time-series database, potentially allowing attackers to override legitimate data inputs.

Immediate Action: Upgrade to version 2026.06.1 or later to resolve the path traversal and data integrity flaws.

Proactive Monitoring: Monitor filesystem access logs for unusual path activity and audit data input logs for irregular patterns that might indicate integrity tampering.

Compensating Controls: Apply strict file system permissions to the application process to limit its ability to access directories outside of its intended scope.

Public Exploit Available: No (exploit_available: false)

Administrators must prioritize updating to version 2026.06.1 to prevent authenticated users from exploiting these path traversal and integrity vulnerabilities. Ensure that access controls are strictly audited to minimize the number of accounts that could potentially reach the vulnerable functions.