CVE-2026-116191

Rclone versions prior to 1.75.2 are vulnerable to a path traversal flaw in the serve webdav functionality. The root cause is the lack of validation for '..' path components , allowing unauthenticated attackers to escape the served root directory. By sending an MKCOL /.. request, an attacker can p...

EUVD-2026-109449

Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send MKCOL /.. to plant a VFS node, then PUT, MOVE, COPY, or MKCOL to create, overwrite, o...