{"metadata": {"vulnerability": "CVE-2026-88046", "count": 19, "kinds": {"milestone": 6, "sighting": 3, "kev": 0, "other": 10}}, "data": [{"timestamp": "2026-09-09T21:22:45.433Z", "date_only": false, "value": "2026-09-09T21:22:45.433Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-88046", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-10T16:14:49.587Z", "date_only": false, "value": "2026-09-10T16:14:49.587Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-88046", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-09-10T16:14:49.587Z", "date_only": false, "value": "2026-09-10T16:14:49.587Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-88046", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-10T17:17:00Z", "date_only": false, "value": "2026-09-10T17:17:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-88046", "record": "UBUNTU-CVE-2026-88046", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-09-10T17:17:08Z", "date_only": false, "value": "2026-09-10T17:17:08Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-38XV-HF3P-H7MQ", "record": "GHSA-38XV-HF3P-H7MQ", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-09-10T17:17:08.677Z", "date_only": false, "value": "2026-09-10T17:17:08.677", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-88046", "record": "FKIE_CVE-2026-88046", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-09-10T17:57:56.353Z", "date_only": false, "value": "2026-09-10T17:57:56.353199Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/f3syrtwtj43lj", "record": "CVE-2026-88046", "field": "creation_timestamp", "uuid": "0fd1e8bf-852d-4908-9497-a040f27445e8", "content": "CVE-2026-88046 - rclone: source object names can escape the configured root on upload\nCVE ID : CVE-2026-88046\n \n Published : Sept. 10, 2026, 5:17 p.m. | 15\u00a0minutes ago\n \n Description : rclone is a command-line program to sync files and directories to and from different cloud s...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/f3syrtwtj43lj"}, {"timestamp": "2026-09-10T22:45:36Z", "date_only": false, "value": "2026-09-10T22:45:36Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-38XV-HF3P-H7MQ", "record": "GHSA-38XV-HF3P-H7MQ", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-09-10T22:45:36Z", "date_only": false, "value": "2026-09-10T22:45:36Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-38XV-HF3P-H7MQ", "record": "GHSA-38XV-HF3P-H7MQ", "field": "modified", "linked_record": true}, {"timestamp": "2026-09-11T00:35:25.412Z", "date_only": false, "value": "2026-09-11T00:35:25.412242Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/rclone/rclone/security/advisories/GHSA-38xv-hf3p-h7mq", "record": "CVE-2026-88046", "field": "creation_timestamp", "uuid": "0b16c893-9e83-49da-a6f0-444f18e5ac05", "url": "https://github.com/rclone/rclone/security/advisories/GHSA-38xv-hf3p-h7mq", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-11T11:32:31.522Z", "date_only": false, "value": "2026-09-11T11:32:31.522761Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/31db43b5866ca861d12e36661fc88337", "record": "CVE-2026-88046", "field": "creation_timestamp", "uuid": "09cc461c-2e9b-46f7-a7d9-1e80c7c6d37d", "content": "# CVE-2026-88046: CVE-2026-88046: Directory Traversal and Root Confinement Escape in rclone Core Engine\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-09-10\n> **Full Report:** https://cvereports.com/reports/CVE-2026-88046\n\n## Summary\nCVE-2026-88046 (also tracked via GHSA-38xv-hf3p-h7mq) is a directory traversal and root confinement escape vulnerability residing in the core listing and transfer logic of rclone. Prior to version 1.75.1, raw relative parent-directory sequences returned by flat-keyspace source backends are trusted and processed without proper sanitization, enabling writes outside the designated target root or bucket.\n\n## TL;DR\nA path traversal vulnerability in rclone versions prior to 1.75.1 allows attackers with control over a source flat-keyspace storage provider to write arbitrary files to unauthorized directories on target backends.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Network / User Interaction Required\n- **CVSS v3.1**: 5.3 (Medium)\n- **Exploit Status**: PoC Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- rclone\n- **rclone**: < 1.75.1 (Fixed in: `1.75.1`)\n\n## Mitigation\n\n- Upgrade rclone client binaries to version 1.75.1 or newer.\n- Audit existing cloud storage namespaces for relative parent-directory sequences (..).\n- Apply principle of least privilege to service accounts used during rclone executions.\n\n**Remediation Steps:**\n1. Identify all production environments using rclone via 'rclone version'.\n2. Deploy rclone 1.75.1 or higher to all running container environments, cron servers, and user workstations.\n3. Audit automated workflows targeting external/untrusted data sources and establish strict validation boundaries.\n\n## References\n\n- [rclone Fix Commit 57842c5ee4e1407eda06a414a36510cce2db4252](https://github.com/rclone/rclone/commit/57842c5ee4e1407eda06a414a36510cce2db4252)\n- [rclone Release v1.75.1](https://github.com/rclone/rclone/releases/tag/v1.75.1)\n- [GitHub Security Advisory GHSA-38xv-hf3p-h7mq](https://github.com/rclone/rclone/security/advisories/GHSA-38xv-hf3p-h7mq)\n- [NVD CVE-2026-88046](https://nvd.nist.gov/vuln/detail/CVE-2026-88046)\n- [CVE.org CVE-2026-88046](https://www.cve.org/CVERecord?id=CVE-2026-88046)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-88046) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/31db43b5866ca861d12e36661fc88337"}, {"timestamp": "2026-09-15T14:47:22.197Z", "date_only": false, "value": "2026-09-15T14:47:22.197480Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-88046", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-15T14:47:22.197Z", "date_only": false, "value": "2026-09-15T14:47:22.197480Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-88046", "record": "FKIE_CVE-2026-88046", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-09-15T14:47:32.868Z", "date_only": false, "value": "2026-09-15T14:47:32.868Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-88046", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-15T14:47:32.868Z", "date_only": false, "value": "2026-09-15T14:47:32.868Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-88046", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-15T15:17:24.440Z", "date_only": false, "value": "2026-09-15T15:17:24.440", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-88046", "record": "FKIE_CVE-2026-88046", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-09-19T08:49:54.492Z", "date_only": false, "value": "2026-09-19T08:49:54.492Z", "kind": "milestone", "label": "Published", "source": "bitnami_vulndb \u00b7 BIT-RCLONE-2026-88046", "record": "BIT-RCLONE-2026-88046", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-09-19T09:02:05.474Z", "date_only": false, "value": "2026-09-19T09:02:05.474Z", "kind": "other", "label": "Updated", "source": "bitnami_vulndb \u00b7 BIT-RCLONE-2026-88046", "record": "BIT-RCLONE-2026-88046", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-17T09:54:16Z", "date_only": false, "value": "2026-10-17T09:54:16Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-88046", "record": "UBUNTU-CVE-2026-88046", "field": "modified", "linked_record": true}], "metrics": {"as_of": "2026-11-03T15:40:37.685Z", "anchors": {"origin": {"timestamp": "2026-09-10T16:14:49.587Z", "date_only": false, "value": "2026-09-10T16:14:49.587Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-88046", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-09-10T16:14:49.587Z", "date_only": false, "value": "2026-09-10T16:14:49.587Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-88046", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-09-11T00:35:25.412Z", "date_only": false, "value": "2026-09-11T00:35:25.412242Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/rclone/rclone/security/advisories/GHSA-38xv-hf3p-h7mq", "record": "CVE-2026-88046", "field": "creation_timestamp", "uuid": "0b16c893-9e83-49da-a6f0-444f18e5ac05", "url": "https://github.com/rclone/rclone/security/advisories/GHSA-38xv-hf3p-h7mq", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": 30035.825, "hours": 8.343284722222222, "days": 0.3476368634259259, "min_seconds": 30035.825, "max_seconds": 30035.825, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-09-10T16:14:49.587Z", "date_only": false, "value": "2026-09-10T16:14:49.587Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-88046", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-09-11T00:35:25.412Z", "date_only": false, "value": "2026-09-11T00:35:25.412242Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/rclone/rclone/security/advisories/GHSA-38xv-hf3p-h7mq", "record": "CVE-2026-88046", "field": "creation_timestamp", "uuid": "0b16c893-9e83-49da-a6f0-444f18e5ac05", "url": "https://github.com/rclone/rclone/security/advisories/GHSA-38xv-hf3p-h7mq", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 4663548.098849, "hours": 1295.4300274580557, "days": 53.97625114408565, "min_seconds": 4663548.098849, "max_seconds": 4663548.098849, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-09-10T16:14:49.587Z", "date_only": false, "value": "2026-09-10T16:14:49.587Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-88046", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-03T15:40:37.685Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 4633512.273849, "hours": 1287.0867427358335, "days": 53.628614280659725, "min_seconds": 4633512.273849, "max_seconds": 4633512.273849, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-09-11T00:35:25.412Z", "date_only": false, "value": "2026-09-11T00:35:25.412242Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/rclone/rclone/security/advisories/GHSA-38xv-hf3p-h7mq", "record": "CVE-2026-88046", "field": "creation_timestamp", "uuid": "0b16c893-9e83-49da-a6f0-444f18e5ac05", "url": "https://github.com/rclone/rclone/security/advisories/GHSA-38xv-hf3p-h7mq", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-03T15:40:37.685Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}