rclone before 1.75.1 Path Traversal via Directory Listing Names
rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allowing path traversal sequences in object names. Attackers can craft special names containing forward slashes and parent directory references to potentially write outside the destination root, though downstream protections in the local backend currently block actual file escape.
BIT-rclone-2026-93986
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:BIT-rclone-2026-93986
rclone
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 1.75.1
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.75.1"
}
]
}
],
"package": {
"name": "rclone",
"purl": "pkg:bitnami/rclone",
"ecosystem": "Bitnami"
},
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"database_specific": {
"source": "https://github.com/bitnami/vulndb/tree/main/data/rclone/BIT-rclone-2026-93986.json"
}
}
]- Related CVEs
- CVE-2026-93986
Source reference:
/aliases
Publisher severity
low
Source reference: /database_specific/severity
- Event
- #25982 · Revision 1
- Added to Heist Feed
- Publisher date