rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP paths into PowerShell hash commands in backend/sftp/sftp.go, and quoteOrEscapeShellPath escapes only ASCII apostrophe even though PowerShell treats U+2018, U+2019, U+201A, and U+201B as single-quote delimiters, allowing an attacker-controlled filename to terminate the intended path literal and append PowerShell statements that execute as the victim SSH account when server-side hashing is invoked. This issue is fixed in v1.75.0.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-71312
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 06:10 UTC · Revision 1
Source evidence
rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution
core-osv · Original sourcePublished 5 Aug 2026, 20:37 UTC
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP paths into PowerShell hash commands in backend/sftp/sftp.go, and quoteOrEscapeShellPath escapes only ASCII apostrophe even though PowerShell treats U+2018, U+2019, U+201A, and U+201B as single-quote delimiters, allowing an attacker-controlled filename to terminate the intended path literal and append PowerShell statements that execute as the victim SSH account when server-side hashing is invoked. This issue is fixed in v1.75.0.
osv:CVE-2026-71312
Complete source record
{
"id": "6b2c063ea623129b15ef4a3b714a159b23aed6529fee5e267c3a7bb2b1fe85be",
"url": "https://osv.dev/vulnerability/CVE-2026-71312",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution",
"summary": "rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP paths into PowerShell hash commands in backend/sftp/sftp.go, and quoteOrEscapeShellPath escapes only ASCII apostrophe even though PowerShell treats U+2018, U+2019, U+201A, and U+201B as single-quote delimiters, allowing an attacker-controlled filename to terminate the intended path literal and append PowerShell statements that execute as the victim SSH account when server-side hashing is invoked. This issue is fixed in v1.75.0.",
"evidence": "osv:CVE-2026-71312",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-71312",
"aliases": [
"BIT-rclone-2026-71312",
"CVE-2026-71312",
"GHSA-2m8m-jhrm-w6j2",
"GO-2026-6182"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/rclone/rclone",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "9ee9d0a0cafd5e5fe3b271d2280b090ab6e64048"
},
{
"fixed": "e122fba1a57641b63a580aa26c026903a84e2e88"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "1.75.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "e122fba1a57641b63a580aa26c026903a84e2e88"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "9ee9d0a0cafd5e5fe3b271d2280b090ab6e64048"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v1.75.0"
}
]
}
}
],
"versions": [
"v1.74.0",
"v1.73.0",
"v1.72.0",
"v1.71.0",
"v1.70.0",
"v1.69.0",
"v1.68.0",
"v1.67.0",
"v1.66.0",
"v1.65.0",
"v1.64.0",
"v1.63.0",
"v1.62.0",
"v1.61.0",
"v1.60.0",
"v1.59.0",
"v1.58.0",
"v1.57.0",
"v1.56.0",
"v1.55.0",
"v1.54.0",
"v1.53.0",
"v1.52.0",
"v1.51.0",
"v1.50.0",
"v1.49.0",
"v1.48.0",
"v1.47.0",
"v1.46.0",
"v1.46",
"v1.45",
"v1.44",
"v1.43",
"v1.42",
"v1.41",
"v1.40",
"v1.39",
"v1.38",
"v1.37",
"v1.36",
"v1.35",
"v1.34",
"v1.33",
"v1.32",
"v1.31",
"v1.30",
"v1.29-1-gbb75d80",
"v1.29",
"v1.28",
"v1.27",
"v1.26",
"v1.25",
"v1.24",
"v1.23",
"v1.22",
"v1.21",
"v1.20",
"v1.19",
"v1.18",
"v1.17",
"v1.16",
"v1.15",
"v1.14",
"v1.13",
"v1.12",
"v1.11",
"v1.10",
"v1.09",
"v1.08",
"v1.07",
"v1.06",
"v1.05",
"v1.04",
"v1.03",
"v1.01",
"v1.00",
"v0.99",
"v0.98",
"v0.97",
"v0.96",
"v0.95",
"v0.94",
"v0.93",
"v0.92",
"v0.91",
"v0.90"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71312.json"
}
}
],
"modified": "2026-10-28T02:30:26.472938230Z",
"provider": "osv",
"references": [
"https://github.com/rclone/rclone/releases/tag/v1.75.0",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71312.json",
"https://github.com/rclone/rclone/security/advisories/GHSA-2m8m-jhrm-w6j2",
"https://nvd.nist.gov/vuln/detail/CVE-2026-71312",
"https://github.com/rclone/rclone/commit/e122fba1a57641b63a580aa26c026903a84e2e88"
],
"provider_metadata": {
"cwe_ids": [
"CWE-78"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71312.json"
}
},
"related_cves": [
{
"value": "CVE-2026-71312",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 492950,
"published_at": "2026-08-05T20:37:49.029+00:00"
}