https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 17:15:21 +0000 https://cve.radiocsirt.org/vuln/bit-rclone-2026-71309 <p><strong>Affected:</strong> Bitnami: rclone</p> <p>rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.40.0 until 1.75.0, rclone serve restic does not correctly reject URL paths beginning with ../ in cmd/serve/restic/restic.go WithRemote, which accepts a leading parent path and passes it to GET, HEAD, POST, and DELETE handlers for configured backends including WebDAV, FTP, HTTP, Memory, and SFTP. An attacker who can access the REST endpoint may read, create, overwrite, or delete objects outside the path configured by the operator when the operator publishes a backend subdirectory and the backend credential can access parent or sibling objects. This issue is fixed in 1.75.0.</p> <p><strong>Affected:</strong> Bitnami: rclone</p> <p>rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.40.0 until 1.75.0, rclone serve restic does not correctly reject URL paths beginning with ../ in cmd/serve/restic/restic.go WithRemote, which accepts a leading parent path and passes it to GET, HEAD, POST, and DELETE handlers for configured backends including WebDAV, FTP, HTTP, Memory, and SFTP. An attacker who can access the REST endpoint may read, create, overwrite, or delete objects outside the path configured by the operator when the operator publishes a backend subdirectory and the backend credential can access parent or sibling objects. This issue is fixed in 1.75.0.</p> https://cve.radiocsirt.org/vuln/bit-rclone-2026-71309 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1125 certfr-2026-avi-1125 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1125 https://cve.radiocsirt.org/vuln/euvd-2026-348896 EUVD-2026-348896 https://cve.radiocsirt.org/vuln/euvd-2026-348896 https://cve.radiocsirt.org/vuln/fkie_cve-2026-71309 <p>rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.40.0 until 1.75.0, rclone serve restic does not correctly reject URL paths beginning with ../ in cmd/serve/restic/restic.go WithRemote, which accepts a leading parent path and passes it to GET, HEAD, POST, and DELETE handlers for configured backends including WebDAV, FTP, HTTP, Memory, and SFTP. An attacker who can access the REST endpoint may read, create, overwrite, or delete objects outside the path configured by the operator when the operator publishes a backend subdirectory and the backend credential can access parent or sibling objects. This issue is fixed in 1.75.0.</p> <p>rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.40.0 until 1.75.0, rclone serve restic does not correctly reject URL paths beginning with ../ in cmd/serve/restic/restic.go WithRemote, which accepts a leading parent path and passes it to GET, HEAD, POST, and DELETE handlers for configured backends including WebDAV, FTP, HTTP, Memory, and SFTP. An attacker who can access the REST endpoint may read, create, overwrite, or delete objects outside the path configured by the operator when the operator publishes a backend subdirectory and the backend credential can access parent or sibling objects. This issue is fixed in 1.75.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-71309 https://cve.radiocsirt.org/vuln/ghsa-45pq-889g-fcgh <p><strong>Affected:</strong> Go: github.com/rclone/rclone</p> <p>## Summary</p> <p>`rclone serve restic` does not correctly reject URL paths beginning with `../`. On affected backends, an attacker who can access the REST endpoint can read, create, overwrite, or delete objects outside the path configured by the operator.</p> <p>The issue affects `rclone v1.40` through `rclone v1.74.4`. The proof of concept and backend matrix were validated with the official Linux AMD64 binary for `v1.74.4`, and the latest `master` commit reviewed at the time (`2217d38`) contained the same vulnerable validation. The main proof of concept uses WsgiDAV as an independent storage server and one rclone process.</p> <p>## Affected versions</p> <p>All releases from `v1.40` through `v1.74.4` are affected.</p> <p>## Affected components and backend propagation</p> <p>The primary vulnerable component is the backend-independent `WithRemote` middleware in `cmd/serve/restic/restic.go`, lines 235-264. It accepts a leading parent component and stores that unsafe relative path in the request context. The REST handlers then pass the same value to whichever rclone backend the operator configured. Therefore, the flaw is not specific to WebDAV.</p> <p>The backend determines whether the accepted `../` path escapes, is preserved, or is encoded as safe filename characters. The source locations and line numbers below correspond to the release used for dynamic testing:</p> <p>| Layer or backend | File and function | Relevant lines | Path propagation | Dynamic evidence | |---|---|---:|---|---| | REST server, primary cause | `cmd/s…</p> <p><strong>Affected:</strong> Go: github.com/rclone/rclone</p> <p>## Summary</p> <p>`rclone serve restic` does not correctly reject URL paths beginning with `../`. On affected backends, an attacker who can access the REST endpoint can read, create, overwrite, or delete objects outside the path configured by the operator.</p> <p>The issue affects `rclone v1.40` through `rclone v1.74.4`. The proof of concept and backend matrix were validated with the official Linux AMD64 binary for `v1.74.4`, and the latest `master` commit reviewed at the time (`2217d38`) contained the same vulnerable validation. The main proof of concept uses WsgiDAV as an independent storage server and one rclone process.</p> <p>## Affected versions</p> <p>All releases from `v1.40` through `v1.74.4` are affected.</p> <p>## Affected components and backend propagation</p> <p>The primary vulnerable component is the backend-independent `WithRemote` middleware in `cmd/serve/restic/restic.go`, lines 235-264. It accepts a leading parent component and stores that unsafe relative path in the request context. The REST handlers then pass the same value to whichever rclone backend the operator configured. Therefore, the flaw is not specific to WebDAV.</p> <p>The backend determines whether the accepted `../` path escapes, is preserved, or is encoded as safe filename characters. The source locations and line numbers below correspond to the release used for dynamic testing:</p> <p>| Layer or backend | File and function | Relevant lines | Path propagation | Dynamic evidence | |---|---|---:|---|---| | REST server, primary cause | `cmd/s…</p> https://cve.radiocsirt.org/vuln/ghsa-45pq-889g-fcgh https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-71309 <p><strong>Affected:</strong> Ubuntu:18.04:LTS: rclone, Ubuntu:Pro:20.04:LTS: rclone, Ubuntu:Pro:22.04:LTS: rclone, Ubuntu:Pro:24.04:LTS: rclone, Ubuntu:Pro:26.04:LTS: rclone</p> <p>rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.40.0 until 1.75.0, rclone serve restic does not correctly reject URL paths beginning with ../ in cmd/serve/restic/restic.go WithRemote, which accepts a leading parent path and passes it to GET, HEAD, POST, and DELETE handlers for configured backends including WebDAV, FTP, HTTP, Memory, and SFTP. An attacker who can access the REST endpoint may read, create, overwrite, or delete objects outside the path configured by the operator when the operator publishes a backend subdirectory and the backend credential can access parent or sibling objects. This issue is fixed in 1.75.0.</p> <p><strong>Affected:</strong> Ubuntu:18.04:LTS: rclone, Ubuntu:Pro:20.04:LTS: rclone, Ubuntu:Pro:22.04:LTS: rclone, Ubuntu:Pro:24.04:LTS: rclone, Ubuntu:Pro:26.04:LTS: rclone</p> <p>rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.40.0 until 1.75.0, rclone serve restic does not correctly reject URL paths beginning with ../ in cmd/serve/restic/restic.go WithRemote, which accepts a leading parent path and passes it to GET, HEAD, POST, and DELETE handlers for configured backends including WebDAV, FTP, HTTP, Memory, and SFTP. An attacker who can access the REST endpoint may read, create, overwrite, or delete objects outside the path configured by the operator when the operator publishes a backend subdirectory and the backend credential can access parent or sibling objects. This issue is fixed in 1.75.0.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-71309 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2679 <p>Ein Angreifer kann mehrere Schwachstellen in rclone ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, und um Sicherheitsvorkehrungen zu umgehen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in rclone ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, und um Sicherheitsvorkehrungen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2679