Vulnerability-Lookup

CVE-2026-71311 (GCVE-0-2026-71311)

Vulnerability from cvelistv5 – Published: 2026-08-05 20:33 – Updated: 2026-08-06 18:44

Title

rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines

Summary

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filename encoding in backend/ftp/ftp.go can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the line-oriented FTP control channel, and github.com/jlaffaye/ftp formats the argument through textproto.Conn.Cmd without rejecting CR or LF, allowing a filename such as victim CRLF DELE other-secret CRLF NOOP to inject an independent authenticated FTP command when the victim copies or syncs to a more-privileged FTP destination. This issue is fixed in 1.75.0.

Severity

6.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-06 18:41 UTC

CWE

CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/rclone/rclone/security/advisor…	x_refsource_CONFIRM
https://github.com/rclone/rclone/commit/1df2b7075…	x_refsource_MISC
https://github.com/rclone/rclone/releases/tag/v1.75.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
rclone	rclone	Affected: < 1.75.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-71311",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-06T18:41:49.120682Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-06T18:44:51.691Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/rclone/rclone/security/advisories/GHSA-8c48-q9wj-3w37"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "rclone",
          "vendor": "rclone",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.75.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filename encoding in backend/ftp/ftp.go can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the line-oriented FTP control channel, and github.com/jlaffaye/ftp formats the argument through textproto.Conn.Cmd without rejecting CR or LF, allowing a filename such as victim CRLF DELE other-secret CRLF NOOP to inject an independent authenticated FTP command when the victim copies or syncs to a more-privileged FTP destination. This issue is fixed in 1.75.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-93",
              "description": "CWE-93: Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T20:33:32.558Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/rclone/rclone/security/advisories/GHSA-8c48-q9wj-3w37",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/rclone/rclone/security/advisories/GHSA-8c48-q9wj-3w37"
        },
        {
          "name": "https://github.com/rclone/rclone/commit/1df2b70753286c1dfe8366078cbedfdf7f96472c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rclone/rclone/commit/1df2b70753286c1dfe8366078cbedfdf7f96472c"
        },
        {
          "name": "https://github.com/rclone/rclone/releases/tag/v1.75.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rclone/rclone/releases/tag/v1.75.0"
        }
      ],
      "source": {
        "advisory": "GHSA-8c48-q9wj-3w37",
        "discovery": "UNKNOWN"
      },
      "title": "rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-71311",
    "datePublished": "2026-08-05T20:33:32.558Z",
    "dateReserved": "2026-08-05T18:14:42.064Z",
    "dateUpdated": "2026-08-06T18:44:51.691Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-71311",
      "date": "2026-09-20",
      "epss": "0.00237",
      "percentile": "0.15063"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "rclone",
                "vendor": "rclone",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 1.75.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filename encoding in backend/ftp/ftp.go can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the line-oriented FTP control channel, and github.com/jlaffaye/ftp formats the argument through textproto.Conn.Cmd without rejecting CR or LF, allowing a filename such as victim CRLF DELE other-secret CRLF NOOP to inject an independent authenticated FTP command when the victim copies or syncs to a more-privileged FTP destination. This issue is fixed in 1.75.0."
          }
        ],
        "id": "CVE-2026-71311",
        "lastModified": "2026-09-09T20:50:00.950",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 6.4,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.2,
              "impactScore": 5.2,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-71311",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-06T18:41:49.120682Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-05T21:16:58.727",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/rclone/rclone/commit/1df2b70753286c1dfe8366078cbedfdf7f96472c"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/rclone/rclone/releases/tag/v1.75.0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/rclone/rclone/security/advisories/GHSA-8c48-q9wj-3w37"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/rclone/rclone/security/advisories/GHSA-8c48-q9wj-3w37"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-93"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-06T06:18:07+00:00",
      "cve": "CVE-2026-71311",
      "id": "CVE-2026-71311",
      "initial_release_date": "2026-08-05T20:33:32.558000+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "github.com/rclone/rclone: rclone: FTP command injection via CRLF in filename encoding",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-71311.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-05T00:29:37Z",
      "cve": "CVE-2026-71311",
      "id": "CVE-2026-71311",
      "initial_release_date": "2026-09-05T00:29:37Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-71311",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-71311.json",
      "version": "2"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-71311",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-06T18:41:49.120682Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-06T18:42:42.783Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/rclone/rclone/security/advisories/GHSA-8c48-q9wj-3w37"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "rclone",
              "vendor": "rclone",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 1.75.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filename encoding in backend/ftp/ftp.go can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the line-oriented FTP control channel, and github.com/jlaffaye/ftp formats the argument through textproto.Conn.Cmd without rejecting CR or LF, allowing a filename such as victim CRLF DELE other-secret CRLF NOOP to inject an independent authenticated FTP command when the victim copies or syncs to a more-privileged FTP destination. This issue is fixed in 1.75.0."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 6.4,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-93",
                  "description": "CWE-93: Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T20:33:32.558Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/rclone/rclone/security/advisories/GHSA-8c48-q9wj-3w37",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/rclone/rclone/security/advisories/GHSA-8c48-q9wj-3w37"
            },
            {
              "name": "https://github.com/rclone/rclone/commit/1df2b70753286c1dfe8366078cbedfdf7f96472c",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/rclone/rclone/commit/1df2b70753286c1dfe8366078cbedfdf7f96472c"
            },
            {
              "name": "https://github.com/rclone/rclone/releases/tag/v1.75.0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/rclone/rclone/releases/tag/v1.75.0"
            }
          ],
          "source": {
            "advisory": "GHSA-8c48-q9wj-3w37",
            "discovery": "UNKNOWN"
          },
          "title": "rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-71311",
        "datePublished": "2026-08-05T20:33:32.558Z",
        "dateReserved": "2026-08-05T18:14:42.064Z",
        "dateUpdated": "2026-08-06T18:44:51.691Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

bit-rclone-2026-71311

Vulnerability from bitnami_vulndb

Published

2026-08-17 05:53

Modified

2026-08-17 06:10

Summary

rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines

Details

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Bitnami",
        "name": "rclone",
        "purl": "pkg:bitnami/rclone"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.75.0"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "severity": [
        {
          "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H",
          "type": "CVSS_V3"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-71311"
  ],
  "database_specific": {
    "cpes": [
      "cpe:2.3:a:rclone:rclone:*:*:*:*:*:go:*:*"
    ],
    "severity": "Medium"
  },
  "details": "rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filename encoding in backend/ftp/ftp.go can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the line-oriented FTP control channel, and github.com/jlaffaye/ftp formats the argument through textproto.Conn.Cmd without rejecting CR or LF, allowing a filename such as victim CRLF DELE other-secret CRLF NOOP to inject an independent authenticated FTP command when the victim copies or syncs to a more-privileged FTP destination. This issue is fixed in 1.75.0.",
  "id": "BIT-rclone-2026-71311",
  "modified": "2026-08-17T06:10:32.268Z",
  "published": "2026-08-17T05:53:32.594Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/rclone/rclone/commit/1df2b70753286c1dfe8366078cbedfdf7f96472c"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rclone/rclone/releases/tag/v1.75.0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rclone/rclone/security/advisories/GHSA-8c48-q9wj-3w37"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71311"
    }
  ],
  "schema_version": "1.6.2",
  "summary": "rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines"
}

CERTFR-2026-AVI-1125

Vulnerability from certfr_avis - Published: 2026-09-07 - Updated: 2026-09-07

De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
VMware	Open Source RabbitMQ	Open Source RabbitMQ versions 4.2.x antérieur à 4.2.10
VMware	Open Source RabbitMQ	Open Source RabbitMQ versions 4.3.x antérieur à 4.3.5
VMware	Open Source RabbitMQ	Open Source RabbitMQ versions 4.0.x antérieur à 4.0.24
VMware	Tanzu	Tanzu for Valkey sur Kubernetes versions antérieures à 13.5.0
VMware	Open Source RabbitMQ	Open Source RabbitMQ versions 4.1.x antérieur à 4.1.15
VMware	Open Source RabbitMQ	Open Source RabbitMQ versions antérieur à 3.13.19

References

Title

Publication Time

Tags

Bulletin de sécurité VMware 38351	2026-09-04	vendor-advisory
Bulletin de sécurité VMware 38353	2026-09-04	vendor-advisory
Bulletin de sécurité VMware 38348	2026-09-04	vendor-advisory
Bulletin de sécurité VMware 38352	2026-09-04	vendor-advisory
Bulletin de sécurité VMware 38350	2026-09-04	vendor-advisory
Bulletin de sécurité VMware 38354	2026-09-04	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Open Source RabbitMQ versions 4.2.x ant\u00e9rieur \u00e0 4.2.10",
      "product": {
        "name": "Open Source RabbitMQ",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Open Source RabbitMQ versions 4.3.x ant\u00e9rieur \u00e0 4.3.5",
      "product": {
        "name": "Open Source RabbitMQ",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Open Source RabbitMQ versions 4.0.x ant\u00e9rieur \u00e0 4.0.24",
      "product": {
        "name": "Open Source RabbitMQ",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Tanzu for Valkey sur Kubernetes versions ant\u00e9rieures \u00e0 13.5.0",
      "product": {
        "name": "Tanzu",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Open Source RabbitMQ versions 4.1.x ant\u00e9rieur \u00e0 4.1.15",
      "product": {
        "name": "Open Source RabbitMQ",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Open Source RabbitMQ versions ant\u00e9rieur \u00e0 3.13.19",
      "product": {
        "name": "Open Source RabbitMQ",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-54369",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54369"
    },
    {
      "name": "CVE-2026-67418",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67418"
    },
    {
      "name": "CVE-2026-67416",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67416"
    },
    {
      "name": "CVE-2024-9681",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-9681"
    },
    {
      "name": "CVE-2026-56862",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56862"
    },
    {
      "name": "CVE-2026-33818",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33818"
    },
    {
      "name": "CVE-2024-46981",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46981"
    },
    {
      "name": "CVE-2026-1965",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-1965"
    },
    {
      "name": "CVE-2026-54572",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54572"
    },
    {
      "name": "CVE-2026-39822",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-39822"
    },
    {
      "name": "CVE-2026-3783",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-3783"
    },
    {
      "name": "CVE-2026-67420",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67420"
    },
    {
      "name": "CVE-2026-8458",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-8458"
    },
    {
      "name": "CVE-2026-6429",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6429"
    },
    {
      "name": "CVE-2026-46600",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-46600"
    },
    {
      "name": "CVE-2026-35469",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-35469"
    },
    {
      "name": "CVE-2026-13757",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13757"
    },
    {
      "name": "CVE-2026-56865",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56865"
    },
    {
      "name": "CVE-2026-59733",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-59733"
    },
    {
      "name": "CVE-2026-56860",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56860"
    },
    {
      "name": "CVE-2026-8932",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-8932"
    },
    {
      "name": "CVE-2026-71309",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-71309"
    },
    {
      "name": "CVE-2026-41989",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41989"
    },
    {
      "name": "CVE-2026-48864",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-48864"
    },
    {
      "name": "CVE-2026-56858",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56858"
    },
    {
      "name": "CVE-2024-11053",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-11053"
    },
    {
      "name": "CVE-2024-7264",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-7264"
    },
    {
      "name": "CVE-2026-11856",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-11856"
    },
    {
      "name": "CVE-2024-51741",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-51741"
    },
    {
      "name": "CVE-2026-67421",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67421"
    },
    {
      "name": "CVE-2025-32023",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-32023"
    },
    {
      "name": "CVE-2026-59732",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-59732"
    },
    {
      "name": "CVE-2026-6253",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6253"
    },
    {
      "name": "CVE-2026-71312",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-71312"
    },
    {
      "name": "CVE-2026-71313",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-71313"
    },
    {
      "name": "CVE-2025-21605",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-21605"
    },
    {
      "name": "CVE-2026-5435",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-5435"
    },
    {
      "name": "CVE-2026-5928",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-5928"
    },
    {
      "name": "CVE-2026-8924",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-8924"
    },
    {
      "name": "CVE-2025-6170",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-6170"
    },
    {
      "name": "CVE-2025-14017",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-14017"
    },
    {
      "name": "CVE-2024-31227",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-31227"
    },
    {
      "name": "CVE-2026-84304",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84304"
    },
    {
      "name": "CVE-2025-48367",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-48367"
    },
    {
      "name": "CVE-2026-58016",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-58016"
    },
    {
      "name": "CVE-2026-67414",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67414"
    },
    {
      "name": "CVE-2026-56859",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56859"
    },
    {
      "name": "CVE-2026-56853",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56853"
    },
    {
      "name": "CVE-2025-13034",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-13034"
    },
    {
      "name": "CVE-2026-42505",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42505"
    },
    {
      "name": "CVE-2026-54370",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54370"
    },
    {
      "name": "CVE-2025-14524",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-14524"
    },
    {
      "name": "CVE-2026-6238",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6238"
    },
    {
      "name": "CVE-2026-4873",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-4873"
    },
    {
      "name": "CVE-2025-27151",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-27151"
    },
    {
      "name": "CVE-2026-5773",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-5773"
    },
    {
      "name": "CVE-2026-8927",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-8927"
    },
    {
      "name": "CVE-2026-6276",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6276"
    },
    {
      "name": "CVE-2024-31449",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-31449"
    },
    {
      "name": "CVE-2026-67412",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67412"
    },
    {
      "name": "CVE-2024-31228",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-31228"
    },
    {
      "name": "CVE-2025-15079",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-15079"
    },
    {
      "name": "CVE-2026-9547",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9547"
    },
    {
      "name": "CVE-2026-67419",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67419"
    },
    {
      "name": "CVE-2026-7168",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-7168"
    },
    {
      "name": "CVE-2026-71311",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-71311"
    },
    {
      "name": "CVE-2025-15224",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-15224"
    },
    {
      "name": "CVE-2026-8286",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-8286"
    },
    {
      "name": "CVE-2026-5545",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-5545"
    },
    {
      "name": "CVE-2026-3784",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-3784"
    },
    {
      "name": "CVE-2026-56864",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56864"
    }
  ],
  "initial_release_date": "2026-09-07T00:00:00",
  "last_revision_date": "2026-09-07T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-1125",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-09-07T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits VMware. Elles permettent \u00e0 un attaquant de provoquer un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits VMware",
  "vendor_advisories": [
    {
      "published_at": "2026-09-04",
      "title": "Bulletin de s\u00e9curit\u00e9 VMware 38351",
      "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38351"
    },
    {
      "published_at": "2026-09-04",
      "title": "Bulletin de s\u00e9curit\u00e9 VMware 38353",
      "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38353"
    },
    {
      "published_at": "2026-09-04",
      "title": "Bulletin de s\u00e9curit\u00e9 VMware 38348",
      "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38348"
    },
    {
      "published_at": "2026-09-04",
      "title": "Bulletin de s\u00e9curit\u00e9 VMware 38352",
      "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38352"
    },
    {
      "published_at": "2026-09-04",
      "title": "Bulletin de s\u00e9curit\u00e9 VMware 38350",
      "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38350"
    },
    {
      "published_at": "2026-09-04",
      "title": "Bulletin de s\u00e9curit\u00e9 VMware 38354",
      "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38354"
    }
  ]
}

FKIE_CVE-2026-71311

Vulnerability from fkie_nvd - Published: 2026-08-05 21:16 - Updated: 2026-09-09 20:50

Severity

6.4 (Medium) - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/rclone/rclone/commit/1df2b70753286c1dfe8366078cbedfdf7f96472c
	security-advisories@github.com	https://github.com/rclone/rclone/releases/tag/v1.75.0
	security-advisories@github.com	https://github.com/rclone/rclone/security/advisories/GHSA-8c48-q9wj-3w37
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/rclone/rclone/security/advisories/GHSA-8c48-q9wj-3w37

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "rclone",
          "vendor": "rclone",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.75.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filename encoding in backend/ftp/ftp.go can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the line-oriented FTP control channel, and github.com/jlaffaye/ftp formats the argument through textproto.Conn.Cmd without rejecting CR or LF, allowing a filename such as victim CRLF DELE other-secret CRLF NOOP to inject an independent authenticated FTP command when the victim copies or syncs to a more-privileged FTP destination. This issue is fixed in 1.75.0."
    }
  ],
  "id": "CVE-2026-71311",
  "lastModified": "2026-09-09T20:50:00.950",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 6.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-71311",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-06T18:41:49.120682Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-05T21:16:58.727",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/rclone/rclone/commit/1df2b70753286c1dfe8366078cbedfdf7f96472c"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/rclone/rclone/releases/tag/v1.75.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/rclone/rclone/security/advisories/GHSA-8c48-q9wj-3w37"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/rclone/rclone/security/advisories/GHSA-8c48-q9wj-3w37"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-93"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-8C48-Q9WJ-3W37

Vulnerability from github – Published: 2026-08-05 20:33 – Updated: 2026-08-05 20:33

Summary

rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines

Details

1. Summary

A valid but nondefault FTP filename encoding can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the line-oriented FTP control channel. The dependency does not reject CR or LF in command arguments, so a filename can inject an independent authenticated command. A real test server observed the injected DELE command.

The default FTP encoding and the configuration-wizard examples include Ctl and are not vulnerable to the demonstrated filename. A manual custom encoding that omits Ctl/CrLf is mandatory and is reflected as High attack complexity. The credible trust boundary is a lower-trust source namespace feeding a more-privileged FTP destination: if the attacker already has equivalent rights on that destination, the report establishes a bug but no privilege gain. Protocol framing must still be enforced at the command sink because a filename-compatibility encoder is not a safe substitute for command-argument validation.

2. Affected Assets & Attack Surface

Verified rclone revision: a0c09f1381ae93e2a9a33c529d170186c61ad058 (v1.74.0-240-ga0c09f138)
Current-master check: the relevant paths remained present at commit 961266888fe797390c535386f3b3aa46f4853602 on 2026-07-18
rclone FTP encoding: backend/ftp/ftp.go:232-248, 768-785
Encoder masks/conversion: lib/encoder/encoder.go:36-68, 121-152, 1144-1165
FTP command sinks: backend/ftp/ftp.go:1071-1173, 1309-1428
Dependency: github.com/jlaffaye/ftp@v0.2.1-0.20251026020404-6602e981a1bb
Dependency command formatting: ftp.go:604-610, with path-bearing callers at ftp.go:893-947, 1010-1026, and 1069-1080
Preconditions: an attacker can create a filename in a source namespace, the victim copies/syncs it to an FTP destination with greater authority, and that destination uses a manually configured encoding that leaves CR/LF raw
Platform note: Unix and some remote backends can supply newline-bearing names; a local Windows source cannot create the demonstrated filename

3. Technical Root Cause Analysis

Rclone represents control characters safely in its internal Standard encoding. Immediately before an FTP operation, FromStandardPath decodes that representation and applies the configured backend mask. If the mask omits Ctl/CrLf, raw newlines are restored. The dependency then formats the resulting argument onto a CRLF-delimited control stream through textproto.Conn.Cmd without validating it. Reversible filename representation is therefore being used as the only protection for a protocol-command boundary.

4. Proof-of-Concept & Evidence

The source filename was equivalent to:

victim\r\nDELE other-secret\r\nNOOP

With the default encoding, no raw newline reached the command. With the valid nondefault configuration encoding = Slash, FromStandardPath restored raw CRLF. During a real FTP path operation, the server parsed DELE other-secret as an independent authenticated command. This establishes injection, not merely unsafe serialization. The test did not establish confidentiality impact or operating-system command execution.

5. Impact Assessment

Injected commands run with the configured FTP account's permissions. Demonstrated direct impact is deletion of a different path, with corresponding integrity and availability loss inside that account. Other FTP filesystem commands may be reachable, but confidentiality and arbitrary operating-system command execution are not claimed. The privilege-boundary case requires the victim's FTP account to have more authority than the attacker has in the source namespace.

6. Remediation Guidance

Reject CR and LF in every FTP command argument at the lowest command-construction boundary.
Apply the check to paths, usernames, passwords, rename arguments, and all other formatted fields.
Return an error rather than silently normalizing an unsafe argument.
Keep the default encoder protection as defense in depth and reject an FTP encoding configuration that can restore CR/LF.
Add end-to-end tests for CR, LF, CRLF, and each path command.

Severity

6.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/rclone/rclone"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.75.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-71311"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-93"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-05T20:33:57Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## 1. Summary\n\nA valid but nondefault FTP filename encoding can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the line-oriented FTP control channel. The dependency does not reject CR or LF in command arguments, so a filename can inject an independent authenticated command. A real test server observed the injected `DELE` command.\n\nThe default FTP encoding and the configuration-wizard examples include `Ctl` and are not vulnerable to the demonstrated filename. A manual custom encoding that omits `Ctl`/`CrLf` is mandatory and is reflected as High attack complexity. The credible trust boundary is a lower-trust source namespace feeding a more-privileged FTP destination: if the attacker already has equivalent rights on that destination, the report establishes a bug but no privilege gain. Protocol framing must still be enforced at the command sink because a filename-compatibility encoder is not a safe substitute for command-argument validation.\n\n## 2. Affected Assets \u0026 Attack Surface\n\n- Verified rclone revision: `a0c09f1381ae93e2a9a33c529d170186c61ad058` (`v1.74.0-240-ga0c09f138`)\n- Current-master check: the relevant paths remained present at commit `961266888fe797390c535386f3b3aa46f4853602` on 2026-07-18\n- rclone FTP encoding: `backend/ftp/ftp.go:232-248`, `768-785`\n- Encoder masks/conversion: `lib/encoder/encoder.go:36-68`, `121-152`, `1144-1165`\n- FTP command sinks: `backend/ftp/ftp.go:1071-1173`, `1309-1428`\n- Dependency: `github.com/jlaffaye/ftp@v0.2.1-0.20251026020404-6602e981a1bb`\n- Dependency command formatting: `ftp.go:604-610`, with path-bearing callers at `ftp.go:893-947`, `1010-1026`, and `1069-1080`\n- Preconditions: an attacker can create a filename in a source namespace, the victim copies/syncs it to an FTP destination with greater authority, and that destination uses a manually configured encoding that leaves CR/LF raw\n- Platform note: Unix and some remote backends can supply newline-bearing names; a local Windows source cannot create the demonstrated filename\n\n## 3. Technical Root Cause Analysis\n\nRclone represents control characters safely in its internal Standard encoding. Immediately before an FTP operation, `FromStandardPath` decodes that representation and applies the configured backend mask. If the mask omits `Ctl`/`CrLf`, raw newlines are restored. The dependency then formats the resulting argument onto a CRLF-delimited control stream through `textproto.Conn.Cmd` without validating it. Reversible filename representation is therefore being used as the only protection for a protocol-command boundary.\n\n## 4. Proof-of-Concept \u0026 Evidence\n\nThe source filename was equivalent to:\n\n```text\nvictim\\r\\nDELE other-secret\\r\\nNOOP\n```\n\nWith the default encoding, no raw newline reached the command. With the valid nondefault configuration `encoding = Slash`, `FromStandardPath` restored raw CRLF. During a real FTP path operation, the server parsed `DELE other-secret` as an independent authenticated command. This establishes injection, not merely unsafe serialization. The test did not establish confidentiality impact or operating-system command execution.\n\n## 5. Impact Assessment\n\nInjected commands run with the configured FTP account\u0027s permissions. Demonstrated direct impact is deletion of a different path, with corresponding integrity and availability loss inside that account. Other FTP filesystem commands may be reachable, but confidentiality and arbitrary operating-system command execution are not claimed. The privilege-boundary case requires the victim\u0027s FTP account to have more authority than the attacker has in the source namespace.\n\n## 6. Remediation Guidance\n\n- Reject CR and LF in every FTP command argument at the lowest command-construction boundary.\n- Apply the check to paths, usernames, passwords, rename arguments, and all other formatted fields.\n- Return an error rather than silently normalizing an unsafe argument.\n- Keep the default encoder protection as defense in depth and reject an FTP encoding configuration that can restore CR/LF.\n- Add end-to-end tests for CR, LF, CRLF, and each path command.",
  "id": "GHSA-8c48-q9wj-3w37",
  "modified": "2026-08-05T20:33:57Z",
  "published": "2026-08-05T20:33:57Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/rclone/rclone/security/advisories/GHSA-8c48-q9wj-3w37"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rclone/rclone/commit/1df2b70753286c1dfe8366078cbedfdf7f96472c"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/rclone/rclone"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rclone/rclone/releases/tag/v1.75.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines"
}

UBUNTU-CVE-2026-71311 (CVE-2026-71311)

Vulnerability from osv_ubuntu – Published: 2026-08-05 21:16 – Updated: 2026-08-13 00:14 – Source website

Details

Severity

6.4 (Medium)


                    
                      CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-71311	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-71311	REPORT
	https://github.com/rclone/rclone/security/advisor…	REPORT
	https://github.com/rclone/rclone/commit/1df2b7075…	REPORT
	https://github.com/rclone/rclone/releases/tag/v1.75.0	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "golang-github-ncw-rclone-dev",
            "binary_version": "1.36-3ubuntu0.2"
          },
          {
            "binary_name": "rclone",
            "binary_version": "1.36-3ubuntu0.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "rclone",
        "purl": "pkg:deb/ubuntu/rclone@1.36-3ubuntu0.2?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.36-3",
        "1.36-3ubuntu0.1",
        "1.36-3ubuntu0.2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "golang-github-rclone-rclone-dev",
            "binary_version": "1.50.2-2ubuntu0.2+esm1"
          },
          {
            "binary_name": "rclone",
            "binary_version": "1.50.2-2ubuntu0.2+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "rclone",
        "purl": "pkg:deb/ubuntu/rclone@1.50.2-2ubuntu0.2+esm1?arch=source\u0026distro=esm-apps/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.47.0+ex1-6",
        "1.47.0+ex1-7",
        "1.49.5-2",
        "1.49.5-3",
        "1.50.2-2",
        "1.50.2-2ubuntu0.1",
        "1.50.2-2ubuntu0.2",
        "1.50.2-2ubuntu0.2+esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "golang-github-rclone-rclone-dev",
            "binary_version": "1.53.3-4ubuntu1.22.04.5+esm1"
          },
          {
            "binary_name": "rclone",
            "binary_version": "1.53.3-4ubuntu1.22.04.5+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:22.04:LTS",
        "name": "rclone",
        "purl": "pkg:deb/ubuntu/rclone@1.53.3-4ubuntu1.22.04.5+esm1?arch=source\u0026distro=esm-apps/jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.53.3-1",
        "1.53.3-2",
        "1.53.3-4",
        "1.53.3-4ubuntu1",
        "1.53.3-4ubuntu1.22.04.1",
        "1.53.3-4ubuntu1.22.04.2",
        "1.53.3-4ubuntu1.22.04.3",
        "1.53.3-4ubuntu1.22.04.3+esm1",
        "1.53.3-4ubuntu1.22.04.4",
        "1.53.3-4ubuntu1.22.04.4+esm1",
        "1.53.3-4ubuntu1.22.04.5",
        "1.53.3-4ubuntu1.22.04.5+esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "golang-github-rclone-rclone-dev",
            "binary_version": "1.60.1+dfsg-3ubuntu0.24.04.6+esm1"
          },
          {
            "binary_name": "rclone",
            "binary_version": "1.60.1+dfsg-3ubuntu0.24.04.6+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:24.04:LTS",
        "name": "rclone",
        "purl": "pkg:deb/ubuntu/rclone@1.60.1+dfsg-3ubuntu0.24.04.6+esm1?arch=source\u0026distro=esm-apps/noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.60.1+dfsg-2build1",
        "1.60.1+dfsg-3",
        "1.60.1+dfsg-3ubuntu0.24.04.1",
        "1.60.1+dfsg-3ubuntu0.24.04.2",
        "1.60.1+dfsg-3ubuntu0.24.04.3",
        "1.60.1+dfsg-3ubuntu0.24.04.4",
        "1.60.1+dfsg-3ubuntu0.24.04.4+esm1",
        "1.60.1+dfsg-3ubuntu0.24.04.5",
        "1.60.1+dfsg-3ubuntu0.24.04.5+esm1",
        "1.60.1+dfsg-3ubuntu0.24.04.6",
        "1.60.1+dfsg-3ubuntu0.24.04.6+esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "golang-github-rclone-rclone-dev",
            "binary_version": "1.60.1+dfsg-4ubuntu3.2+esm1"
          },
          {
            "binary_name": "rclone",
            "binary_version": "1.60.1+dfsg-4ubuntu3.2+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:26.04:LTS",
        "name": "rclone",
        "purl": "pkg:deb/ubuntu/rclone@1.60.1+dfsg-4ubuntu3.2+esm1?arch=source\u0026distro=esm-apps/resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.60.1+dfsg-4ubuntu2",
        "1.60.1+dfsg-4ubuntu3",
        "1.60.1+dfsg-4ubuntu3.1",
        "1.60.1+dfsg-4ubuntu3.1+esm1",
        "1.60.1+dfsg-4ubuntu3.2",
        "1.60.1+dfsg-4ubuntu3.2+esm1"
      ]
    }
  ],
  "aliases": [],
  "details": "rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filename encoding in backend/ftp/ftp.go can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the line-oriented FTP control channel, and github.com/jlaffaye/ftp formats the argument through textproto.Conn.Cmd without rejecting CR or LF, allowing a filename such as victim CRLF DELE other-secret CRLF NOOP to inject an independent authenticated FTP command when the victim copies or syncs to a more-privileged FTP destination. This issue is fixed in 1.75.0.",
  "id": "UBUNTU-CVE-2026-71311",
  "modified": "2026-08-13T00:14:08Z",
  "published": "2026-08-05T21:16:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-71311"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-71311"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/rclone/rclone/security/advisories/GHSA-8c48-q9wj-3w37"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/rclone/rclone/commit/1df2b70753286c1dfe8366078cbedfdf7f96472c"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/rclone/rclone/releases/tag/v1.75.0"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-71311"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-71311 (GCVE-0-2026-71311)

bit-rclone-2026-71311

Vulnerability from bitnami_vulndb

CERTFR-2026-AVI-1125

Solutions

FKIE_CVE-2026-71311

GHSA-8C48-Q9WJ-3W37

1. Summary

2. Affected Assets & Attack Surface

3. Technical Root Cause Analysis

4. Proof-of-Concept & Evidence

5. Impact Assessment

6. Remediation Guidance

UBUNTU-CVE-2026-71311 (CVE-2026-71311)

Tags

Sightings

Nomenclature

Related by attack behaviour