CVE-2026-79781

rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in S3 object keys. Attackers can send requests with object keys like ../root-secret.txt to escape the bucket namespace and access files in t...

CVE-2026-79781

rclone serve s3 before version 1.74.4 contains a path traversal vulnerability in its handling of S3 object keys. An unauthenticated, network-based attacker can include dot-dot (../) segments in object key names (e.g., ../root-secret.txt) to escape the bucket namespace and read or overwrite files ...

EUVD-2026-65539

rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in S3 object keys. Attackers can send requests with object keys like ../root-secret.txt to escape the bucket namespace and access files in t...

CVE-2026-79781 rclone serve s3 Path Traversal via dot-dot object keys

rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in S3 object keys. Attackers can send requests with object keys like ../root-secret.txt to escape the bucket namespace and access files in t...

rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories

Summary rclone serve restic --private-repos exists to let one rclone instance host many users' restic backup repositories behind HTTP Basic auth while keeping each user confined to a path prefix of //. The documentation states the flag "can be used to limit users to repositories starting with a...

GHSA-45PQ-889G-FCGH rclone: Incomplete path validation allows backend root escape in serve restic

Summary rclone serve restic does not correctly reject URL paths beginning with ../. On affected backends, an attacker who can access the REST endpoint can read, create, overwrite, or delete objects outside the path configured by the operator. The issue affects rclone v1.40 through rclone v1.74.4...