Path traversal in rclone - #VU147299
Published: September 7, 2026
Vulnerability identifier: #VU147299
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-22
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local privileged user to mount a remote filesystem at an arbitrary host path, disrupting or shadowing system directories.
The vulnerability exists due to improper limitation of a pathname to a restricted directory in newVolume in cmd/serve/docker/volume.go when processing a Docker VolumeDriver.Create request with a crafted volume name. A local privileged user can submit a request with a crafted volume name to mount a remote filesystem at an arbitrary host path, disrupting or shadowing system directories.
The backing remote filesystem can be specified through the request\'s Opts field.
Affected software
rclone
Remediation
Install security update from vendor's website.
rclone - update to 1.75.1