Path traversal in rclone - #VU155812
Published: October 15, 2026
Vulnerability details
The vulnerability allows a remote attacker to create and overwrite files and directories outside the served root.
The vulnerability exists due to path traversal through an unvalidated '..' path component in rclone's serve webdav implementation when handling MKCOL requests. A remote attacker can send an MKCOL request to /.. followed by crafted write requests through the resulting virtual directory node to create and overwrite files and directories outside the served root.
Exploitation requires a writable served remote with a non-empty root and a backend that joins the root and remote path before encoding path components. Applicable backends include webdav, ftp, sftp, http and memory; local and s3 backends are not affected by this mechanism.