CVE-2026-71313

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From v1.51.0 until v1.75.0, the local backend in backend/local/local.go relies on the configurable filename encoder to prevent remote filename data from becoming operating-system path...

DEBIAN-CVE-2026-71309

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.40.0 until 1.75.0, rclone serve restic does not correctly reject URL paths beginning with ../ in cmd/serve/restic/restic.go WithRemote, which accepts a leading parent path and pass...

CVE-2026-71313

The CVE affects the rclone local backend (local.go) from v1.51.0 through v1.75.0. A faulty filename encoder allows certain encodings (Slash, None, Raw, or Windows-preserving backslash variants) to be decoded into an actual parent-directory component by filepath.Join, enabling an attacker-controll...