Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-08-05T20:13:30 github.com/rclone/rclone: rclone: Backend Root Escape via Incomplete Path Validation 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CWE-22

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.40.0 until 1.75.0, rclone serve restic does not correctly reject URL paths beginning with ../ in cmd/serve/restic/restic.go WithRemote, which accepts a leading parent path and passes it to GET, HEAD, POST, and DELETE handlers for configured backends including WebDAV, FTP, HTTP, Memory, and SFTP. An attacker who can access the REST endpoint may read, create, overwrite, or delete objects outside the path configured by the operator when the operator publishes a backend subdirectory and the backend credential can access parent or sibling objects. This issue is fixed in 1.75.0.

A flaw was found in rclone. The `rclone serve restic` component, which handles cloud storage operations, contains an incomplete path validation vulnerability. An attacker with access to the REST endpoint can exploit this by using specially crafted URL paths containing directory traversal sequences (e.g., `../`). This allows the attacker to read, create, overwrite, or delete objects outside the intended directory, leading to unauthorized data manipulation and a potential escape from the configured backend root.

This flaw is rated as Important. The `rclone serve restic` command, when exposed, is vulnerable to directory traversal due to incomplete path validation. An authenticated attacker with network access to the REST endpoint can read, create, overwrite, or delete objects outside the operator's configured path, leading to data compromise or integrity issues. This vulnerability requires the `rclone serve restic` feature to be actively used and accessible. do not expose rclone serve restic to untrusted clients; bind it to trusted networks only, and avoid publishing a backend subdirectory when the backend credential can also access parent or sibling objects. Prefer serving the exact backend root you intend to expose. Red Hat Advanced Cluster Management for Kubernetes 2 Not affected rhacm2/volsync-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-71309 https://nvd.nist.gov/vuln/detail/CVE-2026-71309 https://github.com/rclone/rclone/commit/cc5a189f00efe68ed0ddb32d3237b42549a9f264 https://github.com/rclone/rclone/releases/tag/v1.75.0 https://github.com/rclone/rclone/security/advisories/GHSA-45pq-889g-fcgh