Path traversal in rclone - #VU147301
Published: September 7, 2026
Vulnerability identifier: #VU147301
CSH Severity: Medium
CVSS v4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to write objects outside the configured destination root.
The vulnerability exists due to improper limitation of a pathname to a restricted directory in destination backend upload path handling when copying a specially crafted source object. A remote attacker can supply a source object containing raw .. path segments to write objects outside the configured destination root.
Exploitation requires a flat-keyspace object-store source containing a raw .. key created with native, non-rclone tooling, and user interaction to copy the object.
Affected software
rclone
Remediation
Install security update from vendor's website.
rclone - update to 1.75.1