rclone: Verbose Stack Trace Disclosure in RC API Error Responses
### Summary When an RC API call triggers a panic (recovered by the job runner), the full Go stack trace is included in the JSON error response. This leaks internal file paths, Go module versions, goroutine state, and memory addresses to the API caller. ### Details The panic recovery in `fs/rc/jobs/job.go:110-115`: ```go func (j *Job) run(ctx context.Context, fn rc.Func, in rc.Params) { defer func() { if r := recover(); r != nil { j.mu.Lock() j.EndTime = time.Now() j.Error = fmt.Sprintf("panic received: %v \n%s", r, string(debug.Stack())) // ... } }() ``` The full `debug.Stack()` output is placed into `j.Error`, which is then returned in the HTTP response JSON. ### PoC Trigger a parse error by setting config path to a non-INI file, then calling dump: ```bash curl -s -X POST http://localhost:5572/config/setpath \ -H "Content-Type: application/json" \ -d '{"path":"/etc/hostname"}' curl -s -X POST http://localhost:5572/config/dump ``` Response includes: ```json { "error": "panic received: fatal error: Failed to load config file \"/etc/hostname\": could not parse line: ... \ngoroutine 9 [running]:\nruntime/debug.Stack()\n\truntime/debug/stack.go:26 +0x64\ngithub.com/rclone/rclone/fs/rc/jobs.(*Job).run.func1()\n\tgithub.com/rclone/rclone/fs/rc/jobs/job.go:112 +0x34\n...", "status": 500 } ``` **Disclosed information includes:** - Full filesystem paths (`github.com/rclone/rclone/fs/config/config.go:377`) - Go module versions (`github.com/go-chi/chi/v5@v5.2.5`) - Go runtime version (f
GHSA-gwfq-86j8-7qhv
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GHSA-gwfq-86j8-7qhv
github.com/rclone/rclone
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 1.75.0
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.75.0"
}
]
}
],
"package": {
"name": "github.com/rclone/rclone",
"purl": "pkg:golang/github.com/rclone/rclone",
"ecosystem": "Go"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-gwfq-86j8-7qhv/GHSA-gwfq-86j8-7qhv.json",
"last_known_affected_version_range": "<= 1.74.4"
}
}
]- Related CVEs
- CVE-2026-79777
Source reference:
/aliases
Publisher severity
low
Source reference: /database_specific/severity
- Event
- #15270 · Revision 1
- Added to Heist Feed
- Publisher date
GO-2026-6181
Revision 1
Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone
Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GO-2026-6181
github.com/rclone/rclone
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 1.75.0
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.75.0"
}
]
}
],
"package": {
"name": "github.com/rclone/rclone",
"purl": "pkg:golang/github.com/rclone/rclone",
"ecosystem": "Go"
},
"database_specific": {
"source": "https://vuln.go.dev/ID/GO-2026-6181.json"
},
"ecosystem_specific": {
"imports": [
{
"path": "github.com/rclone/rclone/fs/rc/jobs",
"symbols": [
"Job.run",
"Jobs.NewJob",
"NewJob",
"NewJobFromBytes",
"NewJobFromParams"
]
}
]
}
}
]- Related CVEs
- CVE-2026-79777
Source reference:
/aliases
Publisher severity
No explicit severity was provided.
- Event
- #15271 · Revision 1
- Added to Heist Feed
- Publisher date