CVE-2026-71311
Description
A flaw was found in rclone, a command-line program for syncing files. A remote attacker could exploit a vulnerability in the FTP backend's filename encoding. When a non-default encoding is used, specially crafted filenames containing carriage return and line feed (CRLF) characters can be injected into the FTP control channel. This allows an attacker to execute arbitrary FTP commands on a more-privileged FTP destination when a victim copies or syncs files, leading to integrity and availability loss within that account.
Statement
This Moderate flaw in rclone allows for FTP command injection when a non-default FTP filename encoding is configured that does not properly handle control characters. Exploitation requires a victim to copy or sync an attacker-controlled filename to a more-privileged FTP destination, limiting the attack's broad applicability.
Mitigation
To mitigate this issue, avoid configuring `rclone` FTP backends with non-default filename encodings that allow raw carriage return or line feed characters. If such a configuration is unavoidable, ensure that all filenames processed by `rclone` from untrusted sources are validated to prevent the injection of arbitrary FTP commands. Additionally, restrict the privileges of the FTP destination to minimize the impact of any potential command injection.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.4 | N/A | 6.4 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | Low | N/A | Low |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Application Data
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
