Skip to content
OpenAdvisories
High WID-SEC-2026-2679 6 CVEs

rclone: Mehrere Schwachstellen

Published Aug 5, 2026 · Updated Aug 5, 2026 · de-DE

Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in rclone ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, und um Sicherheitsvorkehrungen zu umgehen.

Product

Rclone ist ein Open-Source-Befehlszeilenprogramm zur Synchronisierung von Dateien und Verzeichnissen mit verschiedenen Cloud-Speicherdiensten.

Vulnerabilities 6

  • High 8.8
    CVE-2026-59733

    rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories

    Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone serve restic --private-repos enforces authorization using the routed user path segment while building the backend object key …

    rclone rclone telegraf-1.38 rclone Debian Ubuntu Wolfi Go
  • High 8.6
    CVE-2026-71309

    rclone: Incomplete path validation allows backend root escape in serve restic

    rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.40.0 until 1.75.0, rclone serve restic does not correctly reject URL paths beginning with ../ in cmd/serve/restic/restic.go WithRemote, which …

    rclone rclone telegraf-1.38 rclone Debian Ubuntu Wolfi Go
  • High 8.0
    CVE-2026-71312

    rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution

    rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP paths into PowerShell hash commands in backend/sftp/sftp.go, and quoteOrEscapeShellPath escapes onl…

    rclone rclone telegraf-1.38 rclone Debian Ubuntu Wolfi Go
  • Medium 6.9
    CVE-2026-71313

    rclone: Local Encoding Path Traversal

    rclone is a command-line program to sync files and directories to and from different cloud storage providers. From v1.51.0 until v1.75.0, the local backend in backend/local/local.go relies on the configurable filename encoder to prevent remote filename data f…

    rclone rclone telegraf-1.38 rclone Debian Ubuntu Wolfi Go
  • Medium 6.4
    CVE-2026-71311

    rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines

    rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filename encoding in backend/ftp/ftp.go can restore raw CR/LF immediately before an attacker-controlled p…

    rclone rclone telegraf-1.38 rclone Debian Ubuntu Wolfi Go
  • Medium 5.9
    CVE-2026-71310

    rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory

    rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, the shared HTTP CONNECT helper in lib/proxy/http.go parses proxy CONNECT responses with http.ReadResponse over an unrestricted buffe…

    rclone rclone telegraf-1.38 rclone Debian Ubuntu Wolfi Go

Revision history

  1. #1

    Initiale Fassung

References