CRLF injection in rclone - #VU140654
Published: August 1, 2026
Vulnerability details
The vulnerability allows a remote user to inject authenticated FTP commands to modify or delete files on the destination server.
The vulnerability exists due to improper neutralization of CRLF sequences in FTP command arguments in the FTP backend when processing attacker-controlled filenames with a manually configured custom encoding that preserves CR or LF characters. A remote user can supply a specially crafted filename to inject authenticated FTP commands to modify or delete files on the destination server.
User interaction is required because the victim must copy or sync attacker-controlled content to an FTP destination with greater authority, and only manually configured encodings that omit Ctl or CrLf are vulnerable.