CVE-2026-48105

The Arc path traversal (CVE-2026-48105) exposes a design-level error that goes well beyond a missing input check. The vulnerability lives in `applyRegisterFile`, where the only validation is a non-empty path check—an alarmingly thin barrier for a function that operates as a write primitive across a Raft consensus cluster. The critical misunderstanding here is treating cluster membership as a proxy for input safety. Raft guarantees that proposals originate from authorized cluster peers and are consistently ordered—mechanical properties, not semantic ones. A path like `../../etc/passwd` flows through Raft with exactly the same integrity guarantees as `data/metrics.json`. The consensus protocol does its job; the application layer simply never asked whether the proposal content was safe. This is the same conceptual failure that produced directory traversal bugs in web frameworks two decades ago, now reproduced in distributed systems because the underlying assumption—validation means rejecting 'bad' values rather than constraining acceptable ones—persists across substrates. The blast radius is the dimension that elevates this from 'patch and move on' to systemic concern. Path traversal in a Raft FSM isn't a local file-read bug; it's a cluster-wide write primitive. If the storage backend is S3 or equivalent, an attacker with cluster membership can write arbitrary objects that execute across every query node on the next ingestion cycle. These payloads persist through restarts, topology changes, and node replacements. Cleanup isn't 'patch and restart'—it's a full backend audit with no certainty of completeness. The recommended workaround—restrict cluster network access—is functionally impossible for production telemetry deployments that require open network policies to function. This creates an exposure gap: the fix may be available before it can be deployed under real operational constraints. That gap is where systemic risk compounds. Audit every `apply*` method in Arc's Raft FSM for implicit trust assumptions. If 'cluster membership equals safe content' was the mental model for one handler, it almost certainly permeates others—particularly around manifest handling and storage backend interactions. The absence of semantic validation fuzzing in your test suite is now a known gap. Prioritize adding it before the next CVE in this lineage arrives.

Reviewed through automated stages and approved by a human before publication.