A vulnerability was found in getarcaneapp arcane up to 1.17.2 and classified as critical. This impacts an unknown function of the file /api/templates/fetch. Such manipulation of the argument url leads to server-side request forgery.
This vulnerability is listed as CVE-2026-40242. The attack may be performed from remote. There is no available exploit.
It is suggested to upgrade the affected component.
