https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 07:39:02 +0000 https://cve.radiocsirt.org/vuln/bit-rclone-2026-59733 <p><strong>Affected:</strong> Bitnami: rclone</p> <p>Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone serve restic --private-repos enforces authorization using the routed user path segment while building the backend object key from the raw uncleaned URL path, allowing an authenticated user to include .. in a request such as //..//config and read, overwrite, or delete another user&#39;s private repository on backends that clean path components. This issue is fixed in version 1.74.4.</p> <p><strong>Affected:</strong> Bitnami: rclone</p> <p>Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone serve restic --private-repos enforces authorization using the routed user path segment while building the backend object key from the raw uncleaned URL path, allowing an authenticated user to include .. in a request such as //..//config and read, overwrite, or delete another user&#39;s private repository on backends that clean path components. This issue is fixed in version 1.74.4.</p> https://cve.radiocsirt.org/vuln/bit-rclone-2026-59733 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1125 certfr-2026-avi-1125 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1125 https://cve.radiocsirt.org/vuln/euvd-2026-342515 EUVD-2026-342515 https://cve.radiocsirt.org/vuln/euvd-2026-342515 https://cve.radiocsirt.org/vuln/fkie_cve-2026-59733 <p>Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone serve restic --private-repos enforces authorization using the routed user path segment while building the backend object key from the raw uncleaned URL path, allowing an authenticated user to include .. in a request such as //..//config and read, overwrite, or delete another user&#39;s private repository on backends that clean path components. This issue is fixed in version 1.74.4.</p> <p>Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone serve restic --private-repos enforces authorization using the routed user path segment while building the backend object key from the raw uncleaned URL path, allowing an authenticated user to include .. in a request such as //..//config and read, overwrite, or delete another user&#39;s private repository on backends that clean path components. This issue is fixed in version 1.74.4.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-59733 https://cve.radiocsirt.org/vuln/ghsa-fqj9-69pf-6pjg <p><strong>Affected:</strong> Go: github.com/rclone/rclone</p> <p>## Summary</p> <p>`rclone serve restic --private-repos` exists to let one rclone instance host many users&#39; restic backup repositories behind HTTP Basic auth while keeping each user confined to a path prefix of `/&lt;username&gt;/`. The documentation states the flag &#34;can be used to limit users to repositories starting with a path of `/&lt;username&gt;/`&#34;, and the shipped test `TestResticPrivateRepositories` asserts that user `test` may reach `/test/config` but is `403`-blocked from `/other_user/config`. This isolation is the entire security purpose of the flag.</p> <p>The isolation is enforced by two independent chi middlewares that derive the username and the backend object path from two *different* sources, and the path source is never canonicalized. `checkPrivate` authorizes the request by comparing the routed `{userID}` path segment against the authenticated user, while `WithRemote` builds the backend object key from the raw, un-cleaned URL path. A request such as `GET /&lt;me&gt;/../&lt;victim&gt;/config` keeps the first path segment equal to the attacker&#39;s own username (so `checkPrivate` returns the request as authorized) yet hands the backend the literal remote `me/../victim/config`. On any backend that resolves object paths with POSIX `path.Join`/`path.Clean` semantics — which includes the bundled `memory` backend used in the PoC below, and the widely deployed `sftp` and `ftp` backends — that `..` segment collapses, and the operation is performed against the victim&#39;s object.</p> <p>Because the same un-cleaned…</p> <p><strong>Affected:</strong> Go: github.com/rclone/rclone</p> <p>## Summary</p> <p>`rclone serve restic --private-repos` exists to let one rclone instance host many users&#39; restic backup repositories behind HTTP Basic auth while keeping each user confined to a path prefix of `/&lt;username&gt;/`. The documentation states the flag &#34;can be used to limit users to repositories starting with a path of `/&lt;username&gt;/`&#34;, and the shipped test `TestResticPrivateRepositories` asserts that user `test` may reach `/test/config` but is `403`-blocked from `/other_user/config`. This isolation is the entire security purpose of the flag.</p> <p>The isolation is enforced by two independent chi middlewares that derive the username and the backend object path from two *different* sources, and the path source is never canonicalized. `checkPrivate` authorizes the request by comparing the routed `{userID}` path segment against the authenticated user, while `WithRemote` builds the backend object key from the raw, un-cleaned URL path. A request such as `GET /&lt;me&gt;/../&lt;victim&gt;/config` keeps the first path segment equal to the attacker&#39;s own username (so `checkPrivate` returns the request as authorized) yet hands the backend the literal remote `me/../victim/config`. On any backend that resolves object paths with POSIX `path.Join`/`path.Clean` semantics — which includes the bundled `memory` backend used in the PoC below, and the widely deployed `sftp` and `ftp` backends — that `..` segment collapses, and the operation is performed against the victim&#39;s object.</p> <p>Because the same un-cleaned…</p> https://cve.radiocsirt.org/vuln/ghsa-fqj9-69pf-6pjg https://cve.radiocsirt.org/vuln/opensuse-su-2026:11241-1 <p>rclone-1.74.4-1.1 on GA media</p> <p>rclone-1.74.4-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11241-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-59733 <p><strong>Affected:</strong> Ubuntu:18.04:LTS: rclone, Ubuntu:Pro:20.04:LTS: rclone, Ubuntu:Pro:22.04:LTS: rclone, Ubuntu:Pro:24.04:LTS: rclone, Ubuntu:Pro:26.04:LTS: rclone</p> <p>Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone serve restic --private-repos enforces authorization using the routed user path segment while building the backend object key from the raw uncleaned URL path, allowing an authenticated user to include .. in a request such as //..//config and read, overwrite, or delete another user&#39;s private repository on backends that clean path components. This issue is fixed in version 1.74.4.</p> <p><strong>Affected:</strong> Ubuntu:18.04:LTS: rclone, Ubuntu:Pro:20.04:LTS: rclone, Ubuntu:Pro:22.04:LTS: rclone, Ubuntu:Pro:24.04:LTS: rclone, Ubuntu:Pro:26.04:LTS: rclone</p> <p>Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone serve restic --private-repos enforces authorization using the routed user path segment while building the backend object key from the raw uncleaned URL path, allowing an authenticated user to include .. in a request such as //..//config and read, overwrite, or delete another user&#39;s private repository on backends that clean path components. This issue is fixed in version 1.74.4.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-59733 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2266 <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in rclone ausnutzen, um beliebige Dateien zu lesen und zu schreiben, sowie Informationen offenzulegen und Sicherheitsmechanismen zu umgehen.</p> <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in rclone ausnutzen, um beliebige Dateien zu lesen und zu schreiben, sowie Informationen offenzulegen und Sicherheitsmechanismen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2266