Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-08-05T20:37:49 github.com/rclone/rclone: rclone: Server-Side Command Execution via Malicious SFTP Filenames 8.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H CWE-78

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP paths into PowerShell hash commands in backend/sftp/sftp.go, and quoteOrEscapeShellPath escapes only ASCII apostrophe even though PowerShell treats U+2018, U+2019, U+201A, and U+201B as single-quote delimiters, allowing an attacker-controlled filename to terminate the intended path literal and append PowerShell statements that execute as the victim SSH account when server-side hashing is invoked. This issue is fixed in v1.75.0.

A flaw was found in rclone, a command-line program for syncing files. This vulnerability allows a remote attacker to execute arbitrary commands on the server when processing SFTP paths. By crafting a malicious filename that uses specific Unicode single-quote characters, an attacker can bypass security measures and inject PowerShell commands. This can lead to unauthorized command execution under the victim's SSH account during server-side hashing operations.

This is an Important vulnerability in rclone, a command-line file synchronization program, that allows for server-side command execution. An attacker can craft malicious SFTP filenames containing Unicode smart quotes to inject and execute arbitrary PowerShell commands on the system running rclone. This occurs when server-side hashing operations are invoked, potentially leading to compromise of the victim's SSH account. avoid connecting rclone to SFTP servers that use PowerShell as their SSH command shell, or disable server-side hashing with --sftp-disable-hashcheck. Do not process files from untrusted sources on SFTP remotes backed by PowerShell. Red Hat Advanced Cluster Management for Kubernetes 2 Not affected rhacm2/volsync-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-71312 https://nvd.nist.gov/vuln/detail/CVE-2026-71312 https://github.com/rclone/rclone/commit/e122fba1a57641b63a580aa26c026903a84e2e88 https://github.com/rclone/rclone/releases/tag/v1.75.0 https://github.com/rclone/rclone/security/advisories/GHSA-2m8m-jhrm-w6j2