SB2026090795 - Multiple vulnerabilities in rclone

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026090795

SB2026090795 - Multiple vulnerabilities in rclone

Published: September 7, 2026

Security Bulletin ID SB2026090795
CSH Severity
High
Patch available
YES
Number of vulnerabilities 11
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 9% Medium 36% Low 55%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 11 vulnerabilities.


1) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to write outside the listed directory.

The vulnerability exists due to improper limitation of a pathname to a restricted directory in multiple backend listing-response handlers when processing server or third-party listing responses containing crafted object names. A remote attacker can create a crafted shared object containing path traversal sequences to write outside the listed directory.

User interaction is required to initiate processing of the crafted listing.


2) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper bounds checking in backend/local\'s Object.openTranslatedLink function when handling a crafted Range request for a translated symlink object. A remote attacker can send a Range header with an excessively large starting offset to cause a denial of service.

The panic is recovered by Go\'s net/http implementation per connection, causing the affected request or connection to fail rather than terminating the entire server process.


3) Improper Authentication (CVE-ID: N/A)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass authentication and access backend resources as an authenticated user.

The vulnerability exists due to improper authentication in the rclone serve s3 authPairMiddleware when an auth proxy is configured without an auth key. A remote attacker can send a SigV4-signed request using an empty secret to bypass authentication and access backend resources as an authenticated user.

The auth-proxy script does not receive an independent secret to verify for S3 requests.


4) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a local privileged user to mount a remote filesystem at an arbitrary host path, disrupting or shadowing system directories.

The vulnerability exists due to improper limitation of a pathname to a restricted directory in newVolume in cmd/serve/docker/volume.go when processing a Docker VolumeDriver.Create request with a crafted volume name. A local privileged user can submit a request with a crafted volume name to mount a remote filesystem at an arbitrary host path, disrupting or shadowing system directories.

The backing remote filesystem can be specified through the request\'s Opts field.


5) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a local privileged user to mount a remote filesystem at an arbitrary host path, disrupting or shadowing system directories.

The vulnerability exists due to improper limitation of a pathname to a restricted directory in Volume.restoreState when restoring persisted volume state. A local privileged user can supply persisted state containing an escaped mountpoint to mount a remote filesystem at an arbitrary host path, disrupting or shadowing system directories.

A persisted state file written by a vulnerable instance or restored from an untrusted backup or copy can contain an escaped mountpoint.


6) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to write objects outside the configured destination root.

The vulnerability exists due to improper limitation of a pathname to a restricted directory in destination backend upload path handling when copying a specially crafted source object. A remote attacker can supply a source object containing raw .. path segments to write objects outside the configured destination root.

Exploitation requires a flat-keyspace object-store source containing a raw .. key created with native, non-rclone tooling, and user interaction to copy the object.


7) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to write files outside the intended destination directory.

The vulnerability exists due to improper limitation of a pathname to a restricted directory in the archive/zip backend\'s readZip function when processing crafted zip entry names. A remote attacker can supply a crafted zip archive containing traversal entry names to write files outside the intended destination directory.

User interaction is required to process the crafted archive with rclone copy or sync.


8) Information disclosure (CVE-ID: N/A)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper redirect handling in the HTTP backend when following redirects to a different host. A remote attacker can cause a configured remote to redirect requests to another host to disclose sensitive information.

Configured custom headers can be forwarded to a different host, and Authorization and Cookie headers may be transmitted in cleartext following an HTTPS-to-HTTP redirect to the same host.


9) Link following (CVE-ID: N/A)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 5.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to modify permissions, ownership, or timestamps of arbitrary files or directories outside the backup destination.

The vulnerability exists due to improper link resolution in rclone\'s local backend directory metadata handling when applying directory metadata to a destination path that is a planted symbolic link. A remote user can provide source contents that cause a symbolic link and attacker-controlled directory metadata to be processed to modify permissions, ownership, or timestamps of arbitrary paths outside the backup destination.

User interaction is required to run rclone copy or sync with --links against an untrusted source. Timestamp changes occur with --links, while permission and ownership changes additionally require --metadata.


10) Uncontrolled Memory Allocation (CVE-ID: N/A)

CWE-ID: CWE-789 - Uncontrolled Memory Allocation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to memory allocation with excessive size value in the S3 streamed multipart UploadPart handler when processing multipart upload requests with an attacker-controlled declared part length. A remote attacker can send a multipart upload request with an oversized declared part length and withhold the request body to cause a denial of service.

Unauthenticated exploitation applies when anonymous S3 mode is enabled.


11) Exposure of Data Element to Wrong Session (CVE-ID: N/A)

CWE-ID: CWE-488 - Exposure of Data Element to Wrong Session

CVSSv4: 8.4 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose and modify data exposed by another backend.

The vulnerability exists due to exposure of a data element to the wrong session in the FTP auth-proxy driver\'s username-global credential map when handling subsequent FTP filesystem operations. A remote user can perform an operation after another user logs in with the same username and a different credential to disclose and modify data exposed by another backend.

Exploitation requires an auth-proxy deployment that accepts distinct credentials for the same username and maps them to different backend authorities.


Remediation

Install update from vendor's website.

References