Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-08-05T20:33:32 github.com/rclone/rclone: rclone: FTP command injection via CRLF in filename encoding 6.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H CWE-93

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filename encoding in backend/ftp/ftp.go can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the line-oriented FTP control channel, and github.com/jlaffaye/ftp formats the argument through textproto.Conn.Cmd without rejecting CR or LF, allowing a filename such as victim CRLF DELE other-secret CRLF NOOP to inject an independent authenticated FTP command when the victim copies or syncs to a more-privileged FTP destination. This issue is fixed in 1.75.0.

A flaw was found in rclone, a command-line program for syncing files. A remote attacker could exploit a vulnerability in the FTP backend's filename encoding. When a non-default encoding is used, specially crafted filenames containing carriage return and line feed (CRLF) characters can be injected into the FTP control channel. This allows an attacker to execute arbitrary FTP commands on a more-privileged FTP destination when a victim copies or syncs files, leading to integrity and availability loss within that account.

This Moderate flaw in rclone allows for FTP command injection when a non-default FTP filename encoding is configured that does not properly handle control characters. Exploitation requires a victim to copy or sync an attacker-controlled filename to a more-privileged FTP destination, limiting the attack's broad applicability. To mitigate this issue, avoid configuring `rclone` FTP backends with non-default filename encodings that allow raw carriage return or line feed characters. If such a configuration is unavoidable, ensure that all filenames processed by `rclone` from untrusted sources are validated to prevent the injection of arbitrary FTP commands. Additionally, restrict the privileges of the FTP destination to minimize the impact of any potential command injection. Red Hat Advanced Cluster Management for Kubernetes 2 Not affected rhacm2/volsync-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-71311 https://nvd.nist.gov/vuln/detail/CVE-2026-71311 https://github.com/rclone/rclone/commit/1df2b70753286c1dfe8366078cbedfdf7f96472c https://github.com/rclone/rclone/releases/tag/v1.75.0 https://github.com/rclone/rclone/security/advisories/GHSA-8c48-q9wj-3w37