{"metadata": {"vulnerability": "CVE-2026-71311", "count": 21, "kinds": {"milestone": 8, "sighting": 2, "kev": 0, "other": 11}}, "data": [{"timestamp": "2026-08-05T18:14:42.064Z", "date_only": false, "value": "2026-08-05T18:14:42.064Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-71311", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-08-05T20:33:32.558Z", "date_only": false, "value": "2026-08-05T20:33:32.558Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-71311", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-08-05T20:33:32.558Z", "date_only": false, "value": "2026-08-05T20:33:32.558Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-71311", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-08-05T20:33:57Z", "date_only": false, "value": "2026-08-05T20:33:57Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-8C48-Q9WJ-3W37", "record": "GHSA-8C48-Q9WJ-3W37", "field": "published"}, {"timestamp": "2026-08-05T20:33:57Z", "date_only": false, "value": "2026-08-05T20:33:57Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-8C48-Q9WJ-3W37", "record": "GHSA-8C48-Q9WJ-3W37", "field": "modified"}, {"timestamp": "2026-08-05T21:16:00Z", "date_only": false, "value": "2026-08-05T21:16:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-71311", "record": "UBUNTU-CVE-2026-71311", "field": "published"}, {"timestamp": "2026-08-05T21:16:58.727Z", "date_only": false, "value": "2026-08-05T21:16:58.727", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-71311", "record": "FKIE_CVE-2026-71311", "field": "published"}, {"timestamp": "2026-08-05T22:35:25.046Z", "date_only": false, "value": "2026-08-05T22:35:25.046954Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/rclone/rclone/security/advisories/GHSA-8c48-q9wj-3w37", "record": "CVE-2026-71311", "field": "creation_timestamp", "uuid": "e8a191e2-50be-4559-bfce-4fb562c21bc9", "url": "https://github.com/rclone/rclone/security/advisories/GHSA-8c48-q9wj-3w37"}, {"timestamp": "2026-08-06T12:31:36.736Z", "date_only": false, "value": "2026-08-06T12:31:36.736967Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/d60715eb4915a2fe25854150e00d6548", "record": "CVE-2026-71311", "field": "creation_timestamp", "uuid": "75646649-7645-4a6c-954e-d2adf9bbeda6", "content": "# CVE-2026-71311: CVE-2026-71311: FTP Command Injection via Path CRLF Injection in rclone FTP Backend\n\n> **CVSS Score:** 6.4\n> **Published:** 2026-08-05\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71311\n\n## Summary\nA protocol-level CRLF injection vulnerability exists in rclone's FTP backend before version 1.75.0. When configured with a non-default filename encoding, rclone allows carriage return and line feed characters to pass directly into the underlying FTP client library. Because the library constructs line-oriented control commands without input validation, an attacker-controlled filename can inject arbitrary FTP commands into the session, allowing unauthorized file deletion and modification on the target server.\n\n## TL;DR\nInsecure filename encoding in rclone's FTP backend combined with lack of validation in the underlying FTP library allows attackers to inject arbitrary FTP commands via crafted filenames.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **Vulnerability Type**: CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')\n- **Attack Vector**: Network (AV:N)\n- **Attack Complexity**: High (AC:H)\n- **Privileges Required**: Low (PR:L)\n- **User Interaction**: Required (UI:R)\n- **CVSS v3.1 Score**: 6.4 (Medium)\n- **Exploit Status**: Proof of Concept / Conceptual\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- rclone versions prior to 1.75.0 utilizing the FTP backend with non-default filename encodings\n- **rclone**: < 1.75.0 (Fixed in: `1.75.0`)\n\n## Mitigation\n\n- Upgrade rclone installations to version 1.75.0 or later.\n- Remove non-default custom encoding options (such as 'None' or 'Slash') from rclone FTP backend configurations to restore default safety filters.\n- Restrict directory write privileges on the synchronization source to prevent untrusted users from introducing files with custom control characters.\n\n**Remediation Steps:**\n1. Identify all production nodes running rclone instances.\n2. Verify configuration files (typically located at ~/.config/rclone/rclone.conf) for custom 'encoding' parameters in FTP server definitions.\n3. Apply the v1.75.0 update across all systems.\n4. Verify compliance by attempting to sync a test file containing safe encoded representations of carriage returns.\n\n## References\n\n- [GitHub Security Advisory GHSA-8c48-q9wj-3w37](https://github.com/rclone/rclone/security/advisories/GHSA-8c48-q9wj-3w37)\n- [Official Patch Commit](https://github.com/rclone/rclone/commit/1df2b70753286c1dfe8366078cbedfdf7f96472c)\n- [rclone v1.75.0 Release Notes](https://github.com/rclone/rclone/releases/tag/v1.75.0)\n- [NVD CVE-2026-71311 Detail Page](https://nvd.nist.gov/vuln/detail/CVE-2026-71311)\n- [CVE.org CVE-2026-71311 Record](https://www.cve.org/CVERecord?id=CVE-2026-71311)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71311) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/d60715eb4915a2fe25854150e00d6548"}, {"timestamp": "2026-08-06T18:41:49.120Z", "date_only": false, "value": "2026-08-06T18:41:49.120682Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-71311", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-08-06T18:41:49.120Z", "date_only": false, "value": "2026-08-06T18:41:49.120682Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-71311", "record": "FKIE_CVE-2026-71311", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-08-06T18:44:51.691Z", "date_only": false, "value": "2026-08-06T18:44:51.691Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-71311", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-08-06T18:44:51.691Z", "date_only": false, "value": "2026-08-06T18:44:51.691Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-71311", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-08-17T05:53:32.594Z", "date_only": false, "value": "2026-08-17T05:53:32.594Z", "kind": "milestone", "label": "Published", "source": "bitnami_vulndb \u00b7 BIT-RCLONE-2026-71311", "record": "BIT-RCLONE-2026-71311", "field": "published"}, {"timestamp": "2026-08-17T06:10:32.268Z", "date_only": false, "value": "2026-08-17T06:10:32.268Z", "kind": "other", "label": "Updated", "source": "bitnami_vulndb \u00b7 BIT-RCLONE-2026-71311", "record": "BIT-RCLONE-2026-71311", "field": "modified"}, {"timestamp": "2026-09-04T00:00:00Z", "date_only": true, "value": "2026-09-04", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1125", "record": "CERTFR-2026-AVI-1125", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-09-07T00:00:00Z", "date_only": false, "value": "2026-09-07T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1125", "record": "CERTFR-2026-AVI-1125", "field": "last_revision_date"}, {"timestamp": "2026-09-07T00:00:00Z", "date_only": false, "value": "2026-09-07T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1125", "record": "CERTFR-2026-AVI-1125", "field": "initial_release_date"}, {"timestamp": "2026-09-07T00:00:00Z", "date_only": false, "value": "2026-09-07T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1125", "record": "CERTFR-2026-AVI-1125", "field": "revisions.0.revision_date"}, {"timestamp": "2026-09-09T20:50:00.950Z", "date_only": false, "value": "2026-09-09T20:50:00.950", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-71311", "record": "FKIE_CVE-2026-71311", "field": "lastModified"}, {"timestamp": "2026-10-17T09:49:44Z", "date_only": false, "value": "2026-10-17T09:49:44Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-71311", "record": "UBUNTU-CVE-2026-71311", "field": "modified"}]}