SUSE CVE-2026-88015

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through...

BIT-TOMCAT-2026-41284 Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling

Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0 through 11.0.21, from 10.1.0 through 10.1.54, from 9.0.0 through 9.0.117. Older, unsupported versions may also be affected. Users are recommended to upgrade to versio...

DEBIAN-CVE-2026-88015

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through...

CVE-2026-88015

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through...

EUVD-2026-75575

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through...

CVE-2026-88046: Improper Limitation of a Pathname to a Restricted Directory

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone core does not reject parent-directory segments in source Object.Remote values before fs/list, fs/walk, fs/sync, and fs/operations pass those values to destination...

PT-2026-89476

Name of the Vulnerable Software and Affected Versions rclone versions prior to 1.75.1 Description When using backend/local with the --links flag or links=true configuration, symlink targets are exposed as .rclonelink objects. A flaw exists where fs.RangeOption.Decode can pass an unchecked positiv...

ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager

Cisco Talos began an investigation after observing a DLL named "verification.google" executing from WebDAV at a Ukrainian government organization. We assess with moderate confidence that the attacks are not targeted at a particular organization, but are a part of a cryptocurrency and...

SUSE CVE-2026-54563

Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, a Cloudreve WebDAV account rooted at a configured folder can send paths such as /dav/%2e%2e/outside.txt because stripPrefix in pkg/webdav/webdav.go joins the decoded request suffix to the account root with...

SUSE CVE-2026-71309

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.40.0 until 1.75.0, rclone serve restic does not correctly reject URL paths beginning with ../ in cmd/serve/restic/restic.go WithRemote, which accepts a leading parent path and pass...

SUSE CVE-2026-79778

rclone before v1.75.0 contains a denial of service vulnerability in the WebDAV TUS creation handler that dereferences a nil response before checking for transport errors. A malicious or compromised configured endpoint can reset connections during TUS uploads to trigger a panic that terminates...

SUSE CVE-2026-79779

rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic authorization and Cookie headers to be replayed over plaintext HTTP after same-host HTTPS-to-HTTP redirects. An on-path attacker observing the plaintext hop can capture and reuse credentials to...

CVE-2026-79778

A flaw was found in rclone. In the WebDAV TUS creation handler, a vulnerability allows a malicious or compromised configured endpoint to trigger a denial of service. By resetting connections during TUS uploads, an attacker can cause the application to panic, terminating processes and halting...

CVE-2026-79779

A flaw was found in rclone. The application fails to reject transport downgrades during redirect handling, which allows Basic authorization and Cookie headers to be replayed over plaintext HTTP following HTTPS-to-HTTP redirects on the same host. An on-path attacker can observe this plaintext...

CVE-2026-55509

WsgiDAV , a Python-based WebDAV server, has a blind SQL injection vulnerability in its sample MySQLBrowserProvider (wsgidav/samples/mysql_dav_provider.py). The affected methods (_exists_record_by_primary_key, _get_field_by_primary_key, _get_record_by_primary_key) concatenate a record key parsed f...

CVE-2026-55509 WsgiDAV: Blind SQL injection in the MySQL provider

WsgiDAV is a generic and extendable WebDAV server based on WSGI. Prior to 4.3.5, the sample MySQLBrowserProvider in wsgidav/samples/mysqldavprovider.py concatenates the record key parsed from a request URL directly into SQL WHERE clauses. The affected existsrecordbyprimarykey, getfieldbyprimaryke...

ownCloud Flaw Exploited to Steal Nuclear Records From Philippine Research Body

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Thursday added a critical security flaw impacting ownCloud to its Known Exploited Vulnerabilities KEV catalog following reports that a Chinese-speaking threat actor weaponized the vulnerability to target a nuclear research body in...

GO-2026-6298 Cloudreve WebDAV (`/dav`) has Path Traversal / Broken Access Control — scoped DAV credential escapes its configured account root in github.com/cloudreve/Cloudreve

Cloudreve WebDAV /dav has Path Traversal / Broken Access Control — scoped DAV credential escapes its configured account root in github.com/cloudreve/Cloudreve...

EUVD-2026-44688

Cloudreve WebDAV /dav has Path Traversal / Broken Access Control — scoped DAV credential escapes its configured account root...

Cloudreve WebDAV (`/dav`) has Path Traversal / Broken Access Control — scoped DAV credential escapes its configured account root

Summary A Cloudreve WebDAV account stores a uri that defines the account's root folder. The WebDAV request handler stripPrefix in pkg/webdav/webdav.go trims the /dav prefix from the request path and joins the remainder to that root with fs.URI.JoinRaw, but never checks that the joined URI stays...