ROOT-APP-GOBINARY-CVE-2026-49980 CVE-2026-49980 in github.com/rclone/rclone - Patched by Root

Root has patched CVE-2026-49980 in the github.com/rclone/rclone package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-71309 CVE-2026-71309 in github.com/rclone/rclone - Patched by Root

Root has patched CVE-2026-71309 in the github.com/rclone/rclone package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-59733 CVE-2026-59733 in github.com/rclone/rclone - Patched by Root

Root has patched CVE-2026-59733 in the github.com/rclone/rclone package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-71312 CVE-2026-71312 in github.com/rclone/rclone - Patched by Root

Root has patched CVE-2026-71312 in the github.com/rclone/rclone package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-88017 CVE-2026-88017 in github.com/rclone/rclone - Patched by Root

Root has patched CVE-2026-88017 in the github.com/rclone/rclone package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-54572 CVE-2026-54572 in github.com/rclone/rclone - Patched by Root

Root has patched CVE-2026-54572 in the github.com/rclone/rclone package for Root:Go. Multiple fixed versions available...

RClone RC - Command Injection

Rclone = 1.48.0 and = 1.48.0 and 1.73.5 contains an unauthenticated local command execution caused by unauthenticated access to the RC endpoint operations/fsinfo with attacker-controlled fs input, letting unauthenticated attackers execute local commands, exploit requires reachable RC deployment...

Rclone RC - Broken Access Control

Rclone = 1.45.0 and = 1.45.0 and 1.73.5 contains a broken access control vulnerability caused by unauthenticated access to the RC endpoint options/set allowing mutation of global runtime configuration, letting unauthenticated attackers access sensitive administrative functions, exploit requires R...

Rclone 1.64.x < 1.75.1 FTP Auth-Proxy Cross-Session Backend Confusion (CVE-2026-88017)

The version of Rclone installed on the remote host is 1.64.x prior to 1.75.1. It is, therefore, affected by a cross-session backend confusion vulnerability: - The FTP auth-proxy driver stores one obscured password per username in a server-wide map and does not bind the credential or the returned...

GO-2026-6458 rclone: FTP cross-session auth-proxy backend confusion in github.com/rclone/rclone

rclone: FTP cross-session auth-proxy backend confusion in github.com/rclone/rclone...

CVE-2026-41179

CVE-2026-41179 — Ejecución Remota de Código sin Autenticación en la API RC de rclone ⚠️ SOLO CON FINES EDUCATIVOS Este repositorio está destinado estrictamente a la investigación de seguridad, la educación y entornos de laboratorio autorizados. PSSec y los contribuyentes de este repositorio no...

BIT-RCLONE-2026-88017 rclone: FTP cross-session auth-proxy backend confusion

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/serve/ftp/ftp.go stores one obscured password per username in the server-wide userPass mapstringstring instead of binding the...

BIT-RCLONE-2026-88016 rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, when backend/local runs with --links, a source .rclonelink object can plant a symlink in the destination and later directory metadata is applied through that path...

passwordcheck

passwordcheck for rclone config files In https://github.com/rclone/rclone/issues/4783 a security issue was found which meant that passwords generated by "rclone config" might be insecure. This program checks your rclone config file for any of those passwords. Installation Download the relevant zi...

CVE-2026-88045

A flaw was found in rclone. A remote attacker can exploit a memory exhaustion vulnerability in the S3 streamed multipart path. By manipulating the Content-Length or X-Amz-Decoded-Content-Length headers, an attacker can cause the application to reserve excessive memory without sending the declared...

CVE-2026-41179

CVE-2026-47668 Test environment for rclone RCE REF1: https://github.com/rclone/rclone/security/advisories/GHSA-jfwf-28xr-xw6q REF2: https://github.com/pssec-io/CVE-2026-41179 rce.py RCE on /operations/fdinfo, redirects output to stderr for convenience root@kitploit: ./rce.py uname -a exit status ...

CVE-2026-88013

A flaw was found in rclone. The HTTP backend in rclone can forward custom or authentication headers, such as API keys, Authorization, or Cookie headers, when following redirects to a different host. This can lead to the disclosure of sensitive information to untrusted destinations. Additionally, ...

CVE-2026-88046

A flaw was found in rclone, a command-line program for syncing files. This vulnerability allows an attacker to bypass configured directory restrictions by including parent-directory segments e.g., '..' in source object names. When a specially crafted source object is uploaded or copied, it can...

CVE-2026-88014

A flaw was found in rclone. This vulnerability, known as Zip Slip, allows a remote attacker to write arbitrary files outside of the intended destination when processing a specially crafted ZIP archive. By manipulating archive entry names, an attacker can bypass path sanitization, leading to...

CVE-2026-88017

creationtimestamp| type| source ---|---|--- 2026-09-11 00:35:23+00:00| published-proof-of-concept| https://github.com/rclone/rclone/security/advisories/GHSA-c476-6w5q-jw77 2026-09-11 11:09:30+00:00| seen| https://gist.github.com/alon710/bdeb340c6c170113e47b6e3cbfb5203b 2026-09-11 16:00:46+00:00|...