CVE-2026-93986

rclone before 1.75.1 contains a path traversal vulnerability in how it handles names from server and third-party listing responses. The tool fails to confine object names to the listed directory, allowing attackers to craft names containing forward slashes and parent directory references (e.g., ....