SB2026080102 - Multiple vulnerabilities in rclone

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026080102

SB2026080102 - Multiple vulnerabilities in rclone

Published: August 1, 2026

Security Bulletin ID SB2026080102
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 16
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 69% Low 31%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 16 vulnerabilities.


1) Division by zero (CVE-ID: N/A)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to divide by zero in github.com/diskfs/go-diskfs filesystem/squashfs.Read as used by rclone's archive backend when parsing a crafted SquashFS image. A remote user can send or access a specially crafted SquashFS image to cause a denial of service.

The issue can terminate an ordinary rclone command and, in archive-backed SFTP deployments, can terminate the entire SFTP server process.


2) Improper Validation of Array Index (CVE-ID: N/A)

CWE-ID: CWE-129 - Improper Validation of Array Index

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper validation of array index in github.com/diskfs/go-diskfs filesystem/squashfs/metadatablock.go as used by rclone's archive backend when parsing a crafted SquashFS image with an out-of-range inode metadata offset. A remote user can send or access a specially crafted SquashFS image to cause a denial of service.

The issue can terminate an ordinary rclone command and, in archive-backed SFTP deployments, can terminate the entire SFTP server process.


3) Infinite loop (CVE-ID: N/A)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to loop with unreachable exit condition in github.com/diskfs/go-diskfs metadata parsing as used by rclone's archive backend when parsing a crafted truncated SquashFS image. A remote user can send or access a specially crafted SquashFS image to cause a denial of service.

The affected operation can continue consuming CPU after the requesting client disconnects, and repeated requests involving distinct malicious archives can amplify resource consumption.


4) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to access, create, overwrite, or delete objects outside the configured backend root.

The vulnerability exists due to path traversal in WithRemote middleware in cmd/serve/restic/restic.go when handling crafted REST endpoint paths beginning with ../. A remote user can send a specially crafted request to access, create, overwrite, or delete objects outside the configured backend root.

Exploitation requires access to the REST endpoint, a published backend subdirectory, and backend credentials with access to parent or sibling objects; the exact effects depend on backend path semantics.


5) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to create or overwrite files outside the configured destination directory.

The vulnerability exists due to path traversal in backend/local.localPath when processing attacker-controlled object names during copy, sync, or move operations to a local destination. A remote attacker can create a specially crafted object name in a remote source to create or overwrite files outside the configured destination directory.

User interaction is required, and exploitation requires a non-default local encoding that preserves filesystem path syntax.


6) Missing Authentication for Critical Function (CVE-ID: N/A)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to missing authentication in the pprof debug handler when handling requests to /debug/pprof/cmdline. A remote attacker can send an unauthenticated request to disclose sensitive information.

The exposed endpoint can reveal the full process command line, including backend credentials passed in argv.


7) Information disclosure (CVE-ID: N/A)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper access control in serveRoot when handling requests to the root rc endpoint. A remote attacker can send an unauthenticated request to disclose sensitive information.

The issue exposes configured remote names through root endpoint enumeration.


8) Cleartext transmission of sensitive information (CVE-ID: N/A)

CWE-ID: CWE-319 - Cleartext Transmission of Sensitive Information

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to cleartext transmission of sensitive information in lib/http server TLS handling when multiple --addr flags are used with --cert and --key. A remote attacker can connect to the service over plaintext to disclose sensitive information.

The issue occurs only when more than one listen address is configured, causing the service to be served without TLS despite certificate settings.


9) NULL pointer dereference (CVE-ID: N/A)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to NULL pointer dereference in lib/http/middleware.go when handling plaintext requests with --client-ca enabled after TLS has been disabled by multiple --addr flags. A remote attacker can send a plaintext request to cause a denial of service.

The process survives because the HTTP server recovers per connection.


10) Information Exposure Through an Error Message (CVE-ID: N/A)

CWE-ID: CWE-209 - Information Exposure Through an Error Message

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper error handling in the RC API job runner when recovering from a panic in an API call. A remote privileged user can trigger a panic and receive a JSON error response containing a full Go stack trace to disclose sensitive information.

The response may expose internal file paths, dependency versions, goroutine state, memory addresses, and the first unparseable line of a target file.


11) NULL pointer dereference (CVE-ID: N/A)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the getTusLocationOrRetry function in the Infinite Scale TUS creation path when handling a transport failure before an HTTP response is received. A remote attacker can cause the configured endpoint to reset the connection during a TUS creation request to cause a denial of service.

User interaction is required to initiate the upload, and process-wide impact is strongest in long-lived VFS mounts or concurrent or multi-remote CLI processes where the panic occurs in an unrecovered goroutine.


12) Allocation of Resources Without Limits or Throttling (CVE-ID: N/A)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in the HTTP CONNECT helper when parsing proxy CONNECT responses. A remote attacker can send a crafted proxy response with excessively large headers to cause a denial of service.

This issue affects configured malicious or compromised proxies, and active on-path actors only for plaintext HTTP proxy connections.


13) CRLF injection (CVE-ID: N/A)

CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVSSv4: 5.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to inject authenticated FTP commands to modify or delete files on the destination server.

The vulnerability exists due to improper neutralization of CRLF sequences in FTP command arguments in the FTP backend when processing attacker-controlled filenames with a manually configured custom encoding that preserves CR or LF characters. A remote user can supply a specially crafted filename to inject authenticated FTP commands to modify or delete files on the destination server.

User interaction is required because the victim must copy or sync attacker-controlled content to an FTP destination with greater authority, and only manually configured encodings that omit Ctl or CrLf are vulnerable.


14) Cleartext transmission of sensitive information (CVE-ID: N/A)

CWE-ID: CWE-319 - Cleartext Transmission of Sensitive Information

CVSSv4: 6 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to cleartext transmission of sensitive information in the WebDAV redirect handling logic when following a same-host HTTPS-to-HTTP redirect. A remote attacker can observe the plaintext hop to disclose sensitive information.

Exploitation requires a legitimate endpoint, gateway, or accelerator to emit the unsafe redirect.


15) Insufficiently protected credentials (CVE-ID: N/A)

CWE-ID: CWE-522 - Insufficiently Protected Credentials

CVSSv4: 6 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to insufficiently protected credentials in the S3 redirect callback when following unsafe redirects that change scheme or host. A remote attacker can induce a redirect that causes IBM IAM bearer tokens or SSE-C key headers to be forwarded to an unintended destination to disclose sensitive information.

The issue affects same-host HTTPS-to-HTTP redirects for IBM IAM bearer authorization and cross-origin redirects for SSE-C and copy-source SSE-C key headers.


16) OS Command Injection (CVE-ID: N/A)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary commands.

The vulnerability exists due to command injection in the backend/sftp PowerShell hash command handling when processing attacker-controlled SFTP filenames during server-side hashing. A remote user can create or rename a file with a specially crafted filename containing Unicode smart quotes to execute arbitrary commands.

Exploitation requires PowerShell as the SSH command shell, SSH exec enabled, and invocation of server-side hashing. User interaction is required to trigger a hash operation.


Remediation

Install update from vendor's website.

References