Rclone vulnerabilities
42 CVEs and advisories name Rclone as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-71313rclone: Local Encoding Path Traversal
- CVE-2026-71312rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution
- CVE-2026-71311rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines
- CVE-2026-71310rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory
- CVE-2026-71309rclone: Incomplete path validation allows backend root escape in serve restic
- CVE-2026-59733rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories
- CVE-2026-54572rclone: Unvalidated symlink target in local `--links` — arbitrary file write from an untrusted remote
- CVE-2026-59732rclone archive extract allows S3 destination prefix escape via crafted archive paths
- CVE-2026-49980Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix
- CVE-2026-41179RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution
- CVE-2026-41176Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution
- CVE-2024-52522Rclone Improper Permission and Ownership Handling on Symlink Targets with --links and --metadata