RClone RC - Command Injection

Rclone = 1.48.0 and = 1.48.0 and 1.73.5 contains an unauthenticated local command execution caused by unauthenticated access to the RC endpoint operations/fsinfo with attacker-controlled fs input, letting unauthenticated attackers execute local commands, exploit requires reachable RC deployment...

Rclone RC - Broken Access Control

Rclone = 1.45.0 and = 1.45.0 and 1.73.5 contains a broken access control vulnerability caused by unauthenticated access to the RC endpoint options/set allowing mutation of global runtime configuration, letting unauthenticated attackers access sensitive administrative functions, exploit requires R...

CVE-2026-71313

A flaw was found in rclone, a command-line program for syncing files. The local backend's filename encoder, when configured in certain ways, can improperly decode remote filenames. This allows an attacker to craft a source object that, when processed, can create or overwrite files outside the...

CVE-2026-71310

A flaw was found in rclone. A remote attacker, by controlling a malicious or compromised proxy server or acting as an on-path attacker for a plaintext HTTP proxy connection, could send oversized HTTP CONNECT response headers. The rclone application's HTTP CONNECT helper processes these responses...

CVE-2026-71311

A flaw was found in rclone, a command-line program for syncing files. A remote attacker could exploit a vulnerability in the FTP backend's filename encoding. When a non-default encoding is used, specially crafted filenames containing carriage return and line feed CRLF characters can be injected...

CVE-2026-71312

A flaw was found in rclone, a command-line program for syncing files. This vulnerability allows a remote attacker to execute arbitrary commands on the server when processing SFTP paths. By crafting a malicious filename that uses specific Unicode single-quote characters, an attacker can bypass...

CVE-2026-71309

A flaw was found in rclone. The rclone serve restic component, which handles cloud storage operations, contains an incomplete path validation vulnerability. An attacker with access to the REST endpoint can exploit this by using specially crafted URL paths containing directory traversal sequences...

Linux Distros Unpatched Vulnerability : CVE-2026-71310

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, the shared HTTP CONNECT helper in...

Linux Distros Unpatched Vulnerability : CVE-2026-71309

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.40.0 until 1.75.0, rclone serve restic does...

Linux Distros Unpatched Vulnerability : CVE-2026-71313

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone is a command-line program to sync files and directories to and from different cloud storage providers. From v1.51.0 until v1.75.0, the local backend in...

Linux Distros Unpatched Vulnerability : CVE-2026-71311

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filena...

Linux Distros Unpatched Vulnerability : CVE-2026-71312

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP...

CVE-2026-71309

creationtimestamp| type| source ---|---|--- 2026-08-05 22:35:42+00:00| published-proof-of-concept| https://github.com/rclone/rclone/security/advisories/GHSA-45pq-889g-fcgh...

CVE-2026-71310

creationtimestamp| type| source ---|---|--- 2026-08-05 22:35:36+00:00| published-proof-of-concept| https://github.com/rclone/rclone/security/advisories/GHSA-xhf4-832v-7xcr...

CVE-2026-71311

creationtimestamp| type| source ---|---|--- 2026-08-05 22:35:25+00:00| published-proof-of-concept| https://github.com/rclone/rclone/security/advisories/GHSA-8c48-q9wj-3w37 2026-08-06 12:31:36+00:00| seen| https://gist.github.com/alon710/d60715eb4915a2fe25854150e00d6548...

CVE-2026-71313

creationtimestamp| type| source ---|---|--- 2026-08-05 22:35:14+00:00| published-proof-of-concept| https://github.com/rclone/rclone/security/advisories/GHSA-7p4m-qxvv-g567 2026-08-06 06:31:10+00:00| seen| https://gist.github.com/alon710/49b7a81d033518d9857d9b26baae89fd...

CVE-2026-71312

creationtimestamp| type| source ---|---|--- 2026-08-05 22:01:31+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msejoydgl52z 2026-08-05 22:35:21+00:00| published-proof-of-concept| https://github.com/rclone/rclone/security/advisories/GHSA-2m8m-jhrm-w6j2 2026-08-06...

DEBIAN-CVE-2026-71313

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From v1.51.0 until v1.75.0, the local backend in backend/local/local.go relies on the configurable filename encoder to prevent remote filename data from becoming operating-system path...

CVE-2026-71313

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From v1.51.0 until v1.75.0, the local backend in backend/local/local.go relies on the configurable filename encoder to prevent remote filename data from becoming operating-system path...

DEBIAN-CVE-2026-71310

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, the shared HTTP CONNECT helper in lib/proxy/http.go parses proxy CONNECT responses with http.ReadResponse over an unrestricted buffered reader, allowing a malicious or...