CVE-2026-93986

Overview

rclone before version 1.75.1 does not properly confine object names received from server and third-party listing responses to the expected directory. This flaw permits crafted path traversal sequences containing slashes and parent directory references within object names. Although downstream local backend protections currently prevent actual file escape, the vulnerability creates potential risks in how paths are processed.

Description

rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allowing path traversal sequences in object names. Attackers can craft special names containing forward slashes and parent directory references to potentially write outside the destination root, though downstream protections in the local backend currently block actual file escape.

Impact

The vulnerability primarily impacts data integrity and system security by allowing untrusted path sequences from remote storage. While local backend protections mitigate immediate file escape, confidentiality and integrity of storage destinations could be threatened if downstream controls are bypassed or misconfigured. This affects administrators and users syncing data from untrusted or malicious third-party storage providers.

Remediation

Upgrade rclone to version 1.75.1 or later where path confinement is properly enforced for server and third-party listing responses. Audit synchronization configurations and ensure downstream local backend protections remain enabled. Avoid syncing data from untrusted or compromised remote storage providers.

Risk context

The vulnerability is rated as low severity with a CVSS v3 score of 3.1 and a CVSS v4 score of 2.3. EPSS data is not currently available. Because downstream protections block actual file escape, the urgency is moderate, but patching is recommended to maintain defense-in-depth.

Affected products

• rclone