CVE-2026-116191
Description
A flaw was found in Rclone's Web Distributed Authoring and Versioning (WebDAV) service. Due to improper validation of directory traversal sequences, a remote, unauthenticated attacker can send specially crafted WebDAV requests containing directory traversal sequences. This vulnerability allows the attacker to plant directory nodes and create, overwrite, or delete files outside the intended root directory, potentially compromising data belonging to other tenants.
Statement
This vulnerability is rated as an Important severity flaw because an unauthenticated network entity can escape the configured directory root to modify or delete arbitrary host files, resulting in a high integrity impact. In typical Red Hat product deployments, rclone functions as a client-side file synchronization tool rather than a persistent network-facing server. Practical exploitation is therefore limited to environments that explicitly launch the WebDAV listener and expose it to untrusted network access.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
--- CME Mitigation Guidance (2026-11-02) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to canonicalize WebDAV request paths and restrict VFS node creation strictly within the configured root directory: upgrade to rclone 1.75.2 (or the fixed Rhacm2/Volsync Rhel/Cryostat/Cryostat Storage Rhel/Rclone builds), which clean and validate request paths to prevent directory traversal sequences before resolving WebDAV VFS nodes, closing all 2 injection vectors (MKCOL request with '..' path traversal component to plant an out-of-bounds VFS node, subsequent PUT, MOVE, COPY, or MKCOL requests resolving through the planted node). Until patched, this is a concern on deployments running rclone serve webdav exposed to network access without authentication, so restrict network access to the WebDAV listener and ensure the service is not exposed to untrusted network traffic without authentication. As a compensating measure, confine application filesystem operations to the configured served base directory to prevent planted VFS nodes from resolving outside the root and inspect incoming HTTP and WebDAV traffic with a Web Application Firewall to block requests containing directory traversal sequences such as '..'. These controls limit blast radius and contain exploitation, but they do not fix the underlying relative path traversal defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1301 Path Traversal Prevention (Canonicalization) (high)
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | High | N/A | High |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Understanding the Weakness (CWE)
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands
The attacker may be able to create or overwrite critical files that are used to execute code, such as programs or libraries.
Integrity
Technical Impact: Modify Files or Directories
The attacker may be able to overwrite or create critical files, such as programs, libraries, or important data. If the targeted file is used for a security mechanism, then the attacker may be able to bypass that mechanism. For example, appending a new account at the end of a password file may allow an attacker to bypass authentication.
Confidentiality
Technical Impact: Read Files or Directories
The attacker may be able to read the contents of unexpected files and expose sensitive data. If the targeted file is used for a security mechanism, then the attacker may be able to bypass that mechanism. For example, by reading a password file, the attacker could conduct brute force password guessing attacks in order to break into an account on the system.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
The attacker may be able to overwrite, delete, or corrupt unexpected critical files such as programs, libraries, or important data. This may prevent the product from working at all and in the case of protection mechanisms such as authentication, it has the potential to lock out product users.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
