CVE-2026-71312 rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP paths into PowerShell hash commands in backend/sftp/sftp.go, and quoteOrEscapeShellPath escapes only ASCII apostrophe even though...

CVE-2026-71312

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP paths into PowerShell hash commands in backend/sftp/sftp.go, and quoteOrEscapeShellPath escapes only ASCII apostrophe even though...

CVE-2026-71312 rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP paths into PowerShell hash commands in backend/sftp/sftp.go, and quoteOrEscapeShellPath escapes only ASCII apostrophe even though...

CVE-2026-71312

Summary of CVE-2026-71312 : In rclone (pre-1.75.0), the code path in backend/sftp/sftp.go interpolates remote SFTP paths into PowerShell hash commands and uses quoteOrEscapeShellPath that escapes only ASCII apostrophes. This can allow an attacker-controlled filename to terminate the path literal ...

rclone: WebDAV Credentials Survive a Same-Host HTTPS-to-HTTP Redirect

Summary WebDAV's default redirect handling can replay Basic authorization and configured Cookie headers over plaintext HTTP after a same-host HTTPS-to-HTTP redirect. This was reproduced through the real backend. Unlike the low-impact STS token in rclone's published S3 redirect advisory, Basic...

GHSA-8C48-Q9WJ-3W37 rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines

Summary A valid but nondefault FTP filename encoding can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the line-oriented FTP control channel. The dependency does not reject CR or LF in command arguments, so a filename can inject an independent...

CVE-2026-71311 rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filename encoding in backend/ftp/ftp.go can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the...

CVE-2026-71311

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filename encoding in backend/ftp/ftp.go can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the...

EUVD-2026-53618

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filename encoding in backend/ftp/ftp.go can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the...

CVE-2026-71311 rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filename encoding in backend/ftp/ftp.go can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the...

CVE-2026-71311

rclone (pre-1.75.0) is affected by a CRLF injection in FTP filename handling: a valid but nondefault encoding in backend/ftp/ftp.go can restore raw CR/LF before an attacker-controlled path is interpolated into the FTP control channel. github.com/jlaffaye/ftp formats the argument via textproto.Con...

GHSA-8V25-V8P6-QF7V rclone: Path traversal in serve s3 allows reading and overwriting root-level files

Summary rclone serve s3 allows a client to read and write files at the root of the remote which would normally be inaccessible by using dot-dot path segments in the object key. It does not allow reading files outside of the root. A request such as GET /bucket/../root-secret.txt is handled as an...

rclone: Path traversal in serve s3 allows reading and overwriting root-level files

Summary rclone serve s3 allows a client to read and write files at the root of the remote which would normally be inaccessible by using dot-dot path segments in the object key. It does not allow reading files outside of the root. A request such as GET /bucket/../root-secret.txt is handled as an...

GHSA-3X6R-WXXG-53VV rclone: Infinite Scale TUS Creation Transport Error Causes a Nil-Response Panic

Summary A transport failure during the initial Infinite Scale TUS creation POST can return nil response, non-nil error. Rclone dereferences the nil response before processing the error and panics. The production CreateUploader path reproduced the crash against a closed endpoint. The security...

GHSA-XHF4-832V-7XCR rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory

Summary The shared HTTP CONNECT helper parses a proxy response with http.ReadResponse over an unrestricted buffered reader. The production helper accepted a valid response containing a 2 MiB header in three consecutive runs. A malicious or compromised configured proxy, or an active on-path actor...

rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory

Summary The shared HTTP CONNECT helper parses a proxy response with http.ReadResponse over an unrestricted buffered reader. The production helper accepted a valid response containing a 2 MiB header in three consecutive runs. A malicious or compromised configured proxy, or an active on-path actor...

CVE-2026-71310

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, the shared HTTP CONNECT helper in lib/proxy/http.go parses proxy CONNECT responses with http.ReadResponse over an unrestricted buffered reader, allowing a malicious or...

CVE-2026-71310

The CVE affects the rclone project before version 1.75.0, where the shared HTTP CONNECT helper in lib/proxy/http.go incorrectly parses proxy CONNECT responses using http.ReadResponse over an unrestricted reader. This unbounded parsing enables a malicious or on-path proxy to send oversized headers...

EUVD-2026-53615

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, the shared HTTP CONNECT helper in lib/proxy/http.go parses proxy CONNECT responses with http.ReadResponse over an unrestricted buffered reader, allowing a malicious or...

CVE-2026-71310 rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, the shared HTTP CONNECT helper in lib/proxy/http.go parses proxy CONNECT responses with http.ReadResponse over an unrestricted buffered reader, allowing a malicious or...