Most recent entries from all

BIT-rclone-2026-71312 — rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution

Affected: Bitnami: rclone

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP paths into PowerShell hash commands in backend/sftp/sftp.go, and quoteOrEscapeShellPath escapes only ASCII apostrophe even though PowerShell treats U+2018, U+2019, U+201A, and U+201B as single-quote delimiters, allowing an attacker-controlled filename to terminate the intended path literal and append PowerShell statements that execute as the victim SSH account when server-side hashing is invoked. This issue is fixed in v1.75.0.

certfr-2026-avi-1125 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer…

certfr-2026-avi-1125

EUVD-2026-349195

fkie_cve-2026-71312

GHSA-2m8m-jhrm-w6j2 — rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution

Affected: Go: github.com/rclone/rclone

## 1. Summary

rclone interpolates remote SFTP paths into PowerShell hash commands. Its quoting helper escapes only ASCII apostrophe, although PowerShell accepts four Unicode smart quotes as single-quote delimiters. An attacker-controlled filename can therefore terminate the intended path literal and append PowerShell statements executed as the victim's SSH account.

## 2. Affected Assets & Attack Surface

- Audited commit: `a0c09f1381ae93e2a9a33c529d170186c61ad058` - Backend: `backend/sftp` - Relevant code: - `backend/sftp/sftp.go:1802-1812` — PowerShell hash commands - `backend/sftp/sftp.go:1663-1699` — `Fs.run` - `backend/sftp/sftp.go:1988-2067` — `Object.Hash` - `backend/sftp/sftp.go:2071-2090` — `quoteOrEscapeShellPath` - Exposed input: remote filename controlled by an SFTP collaborator, upstream storage source, or other party able to create or rename files. - Required execution context: PowerShell as the SSH command shell, SSH exec enabled, and server-side hashing invoked.

## 3. Technical Root Cause Analysis

For PowerShell, `quoteOrEscapeShellPath` wraps a path in ASCII apostrophes and doubles only `U+0027`:

```go return "'" + strings.ReplaceAll(shellPath, "'", "''") + "'", nil ```

Windows PowerShell also treats `U+2018`, `U+2019`, `U+201A`, and `U+201B` as single-quote delimiters. Those characters pass through the rclone encoder and can close the quoted path. The completed string is sent as shell source through an SSH exec request.

The security boundary f…

UBUNTU-CVE-2026-71312

Affected: Ubuntu:18.04:LTS: rclone, Ubuntu:Pro:20.04:LTS: rclone, Ubuntu:Pro:22.04:LTS: rclone, Ubuntu:Pro:24.04:LTS: rclone, Ubuntu:Pro:26.04:LTS: rclone

WID-SEC-W-2026-2679 — rclone: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in rclone ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, und um Sicherheitsvorkehrungen zu umgehen.