rclone

Disclosed vulnerabilities where the NVD names rclone as an affected vendor, highest CVSS first.

1. HIGH 7.5CVE-2026-116191public PoC2026-10-25

   Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send MKCOL /.. to plant a VFS node, then PUT, MOVE, C…

   rclone

   AI risk analysis on Exploit-DB.ai →

2. HIGH 7.5CVE-2026-116189public PoC2026-10-25

   rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the release distribution path can prepend an unsigned…

   rclone

   AI risk analysis on Exploit-DB.ai →

3. MEDIUM 6.8CVE-2026-116194public PoC2026-10-25

   Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost OAuth callback, which disables the state check and trusts the hostname parameter. Malicious web pages can send a stateless request to port 53…

   rclone

   AI risk analysis on Exploit-DB.ai →

4. MEDIUM 6.1CVE-2026-116195public PoC2026-10-25

   Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which trims the .rclonelink suffix from a path after the containment check, so a name can resolve outside the destination root. Attackers can plant a di…

   rclone

   AI risk analysis on Exploit-DB.ai →

5. MEDIUM 5.9CVE-2026-116192public PoC2026-10-25

   rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backend requests by supplying a double-slash root on an existing named remote via --rc-serve. Attackers ca…

   rclone

   AI risk analysis on Exploit-DB.ai →

6. MEDIUM 5.3CVE-2026-116196public PoC2026-10-25

   Rclone before v1.75.2 contains a credential exposure vulnerability in the b2 backend that leaks the live account Authorization token and SSE-C keys on HTTP redirects from --b2-download-url hosts. Attackers can observe a same-host HTTPS-to-HTTP downgrade redire…

   rclone

   AI risk analysis on Exploit-DB.ai →

7. MEDIUM 5.3CVE-2026-116193public PoC2026-10-25

   Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS requests. Attackers can probe arbitrary paths and compare Allow header values to determi…

   rclone

   AI risk analysis on Exploit-DB.ai →

8. MEDIUM 5.3CVE-2026-116188public PoC2026-10-25

   rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory accounting that bypasses the configured buffer limit. Attackers can open two concurrent current-part PUT requests declaring huge lengths to wrap…

   rclone

   AI risk analysis on Exploit-DB.ai →

9. MEDIUM 5CVE-2026-116187public PoC2026-10-25

   Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy that allows authenticated tenants to manipulate other tenants' multipart uploads by referencing their upload IDs. Attackers who learn a victim's bucket, …

   rclone

   AI risk analysis on Exploit-DB.ai →

10. LOW 3.7CVE-2026-116190public PoC2026-10-25

    rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards operator-configured custom credential headers to different hosts on HTTP 3xx redirects. Attackers who control or influence a cross-host redi…

    rclone

    AI risk analysis on Exploit-DB.ai →