debian/rclone vulnerabilities

Latest debian/rclone CVEs

Newest publication first · page 1 of 2

1. CVE-2026-116196 Rclone before v1.75.2 B2 Credential Leak on Redirect via --b2-download-url

   Published 2026-10-25

   Medium·CVSS 6.0 EPSS 0.06%

   Rclone before v1.75.2 contains a credential exposure vulnerability in the b2 backend that leaks the live account Authorization token and SSE-C keys on HTTP redirects from --b2-download-url hosts. Attackers can observe a same-host HTTPS-to-HTTP downgrade redirect to capture the cl...

2. CVE-2026-116195 Rclone before 1.75.2 Path Traversal via translateLink .rclonelink Suffix Trim

   Published 2026-10-25

   High·CVSS 7.0 EPSS 0.23%

   Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which trims the .rclonelink suffix from a path after the containment check, so a name can resolve outside the destination root. Attackers can plant a directory named ...rcl...

3. CVE-2026-116194 Rclone 1.52.0 before 1.75.2 CSRF via pCloud OAuth Callback

   Published 2026-10-25

   High·CVSS 7.6 EPSS 0.12%

   Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost OAuth callback, which disables the state check and trusts the hostname parameter. Malicious web pages can send a stateless request to port 53682 during authoriza...

4. CVE-2026-116192 rclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote roots

   Published 2026-10-25

   High·CVSS 8.2 EPSS 0.22%

   rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backend requests by supplying a double-slash root on an existing named remote via --rc-serve. Attackers can make HEAD/GET requ...

5. CVE-2026-116191 Rclone before 1.75.2 Path Traversal via serve webdav MKCOL

   Published 2026-10-25

   High·CVSS 8.7 EPSS 0.39%

   Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send MKCOL /.. to plant a VFS node, then PUT, MOVE, COPY, or MKCOL to cre...

6. CVE-2026-116190 rclone v1.56.0 before v1.75.2 WebDAV Credential Header Leak on Redirect

   Published 2026-10-25

   Medium·CVSS 6.3 EPSS 0.19%

   rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards operator-configured custom credential headers to different hosts on HTTP 3xx redirects. Attackers who control or influence a cross-host redirect can capture hea...

7. CVE-2026-116189 rclone 1.55.0 before 1.75.2 selfupdate Signature Verification Bypass via SHA256SUMS

   Published 2026-10-25

   High·CVSS 7.7 EPSS 0.14%

   rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the release distribution path can prepend an unsigned checksum line match...

8. CVE-2026-116188 rclone serve s3 1.75.0 before 1.75.2 Memory Limit Bypass via Multipart Overflow

   Published 2026-10-25

   Medium·CVSS 6.9 EPSS 0.25%

   rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory accounting that bypasses the configured buffer limit. Attackers can open two concurrent current-part PUT requests declaring huge lengths to wrap the signed int64 co...

9. CVE-2026-116187 Rclone v1.68.0 before v1.75.2 Authorization Bypass in serve s3 Multipart Uploads

   Published 2026-10-25

   Medium·CVSS 6.1 EPSS 0.14%

   Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy that allows authenticated tenants to manipulate other tenants' multipart uploads by referencing their upload IDs. Attackers who learn a victim's bucket, object, and upload I...

10. CVE-2026-93987 rclone serve docker Path Traversal via Volume Name

    Published 2026-09-19

    Medium·CVSS 4.6 EPSS 0.15%

    rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in the rclone serve docker volume plugin. newVolume() in cmd/serve/docker/volume.go computes a volume's mountpoint as filepath.Join(drv.root, name) from the attacker-supplied name field of a Docker Volum...

11. CVE-2026-93986 rclone before 1.75.1 Path Traversal via Directory Listing Names

    Published 2026-09-19

    Low·CVSS 2.3 EPSS 0.29%

    rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allowing path traversal sequences in object names. Attackers can craft special names containing forward slashes and parent directory references to potentially write...

12. CVE-2026-88046 rclone: source object names can escape the configured root on upload

    Published 2026-09-10

    Medium·CVSS 5.3 EPSS 0.29%

    rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone core does not reject parent-directory segments in source Object.Remote() values before fs/list, fs/walk, fs/sync, and fs/operations pass those val...

13. CVE-2026-88045 rclone: S3 multipart declared-length memory exhaustion

    Published 2026-09-10

    High·CVSS 7.5 EPSS 0.63%

    rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.75.0 until 1.75.1, the serve S3 streamed multipart path in cmd/serve/s3/multipart.go passes attacker-controlled contentLength to multipart.NewRW().Reserve before r...

14. CVE-2026-88044 rclone: RC per-server auth-proxy bypass

    Published 2026-09-10

    Critical·CVSS 9.1 EPSS 0.49%

    rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.70.0 until 1.75.1, the serve/start RC interface accepts per-server proxyOpt.AuthProxy settings, and the FTP and S3 constructors in cmd/serve/ftp/ftp.go and cmd/ser...

15. CVE-2026-88018 rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass

    Published 2026-09-10

    Critical·CVSS 9.8 EPSS 0.51%

    rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with --auth-proxy but without --auth-key allows authPairMiddleware to register any client-chosen accessKeyID with an empty ws....

16. CVE-2026-88017 rclone: FTP cross-session auth-proxy backend confusion

    Published 2026-09-10

    High·CVSS 7.3 EPSS 0.23%

    rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/serve/ftp/ftp.go stores one obscured password per username in the server-wide userPass map[string]string instea...

17. CVE-2026-88016 rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination

    Published 2026-09-10

    High·CVSS 7.1 EPSS 0.19%

    rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, when backend/local runs with --links, a source .rclonelink object can plant a symlink in the destination and later directory metadata is applied through...

18. CVE-2026-88015 rclone local: crafted Range request against a translated symlink panics (DoS)

    Published 2026-09-10

    Medium·CVSS 5.3 EPSS 0.36%

    rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range s...

19. CVE-2026-88014 rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace

    Published 2026-09-10

    Medium·CVSS 6.3 EPSS 0.15%

    rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend method (*Fs).readZip in backend/archive/zip/zip.go accepts archive/zip.File.Name values from an untrusted central direct...

20. CVE-2026-88013 rclone: http backend forwards custom/auth headers to a different host on redirect

    Published 2026-09-10

    Medium·CVSS 5.3 EPSS 0.19%

    rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.49.0 until 1.75.1, the HTTP backend attaches headers configured through --http-headers or headers= to requests in backend/http/http.go, while its fshttp.NewClient...

21. CVE-2026-79782 rclone before 1.74.4 Security Token Disclosure via HTTPS to HTTP Redirect

    Published 2026-08-25

    Critical·CVSS 9.3 EPSS 0.13%

    rclone before 1.74.4 fails to strip the X-Amz-Security-Token header when an S3 redirect changes scheme from HTTPS to HTTP on the same host. Attackers can intercept plaintext HTTP traffic to capture AWS STS session tokens sent in request headers.

22. CVE-2026-79783 rclone before 1.74.4 Privilege Escalation via setuid Metadata

    Published 2026-08-25

    Low·CVSS 2.0 EPSS 0.23%

    rclone before 1.74.4 fails to mask special permission bits when applying source-supplied mode metadata in the local backend, allowing attackers to set setuid/setgid bits on attacker-controlled files. When copying with metadata preservation from an untrusted remote, attackers can...

23. CVE-2026-79781 rclone serve s3 Path Traversal via dot-dot object keys

    Published 2026-08-25

    Medium·CVSS 6.9 EPSS 0.30%

    rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in S3 object keys. Attackers can send requests with object keys like ../root-secret.txt to escape the bucket namespace and...

24. CVE-2026-79780 rclone before v1.75.0 Credential Exposure via S3 Redirect

    Published 2026-08-25

    Medium·CVSS 6.0 EPSS 0.15%

    rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks, allowing credentials to be preserved across scheme or host changes. Attackers observing network traffic from a trusted endpoint can capture reusable IBM IAM token...

25. CVE-2026-79779 rclone before v1.75.0 WebDAV Credential Exposure via HTTPS-to-HTTP Redirect

    Published 2026-08-25

    Medium·CVSS 6.0 EPSS 0.11%

    rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic authorization and Cookie headers to be replayed over plaintext HTTP after same-host HTTPS-to-HTTP redirects. An on-path attacker observing the plaintext hop can capture and reu...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.