Rclone CVE-2018-12907

Authentication bypass in rclone's S3 server mode (rclone serve s3) allows any unauthenticated network attacker to impers

PowerShell smart-quote filename injection in rclone's SFTP backend allows an attacker who controls remote filenames to e

An issue was discovered in Rclone before 1.53.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita

Cross-session credential isolation failure in rclone's FTP auth-proxy driver (versions 1.64.0-1.75.0) allows an authenti

Symlink escape in rclone's local backend (prior to v1.75.1) allows an attacker who controls sync source contents to appl

FTP CRLF injection in rclone before 1.75.0 allows an attacker who can place crafted filenames in a source namespace to i

Path traversal in rclone prior to 1.75.1 allows an attacker who can populate a source object store with raw `..` key seg

Cleartext disclosure of AWS STS session tokens affects rclone before 1.74.4 when its S3 backend follows a redirect that

Authentication/authorization bypass in rclone's dynamic serve interface (versions 1.70.0 through 1.75.0) lets remote att

Path traversal in the `rclone serve restic --private-repos` REST server (versions prior to 1.74.4) allows an authenticat

Arbitrary file write via symlink traversal in Rclone prior to 1.74.4 lets an attacker-controlled remote escape the local

Memory exhaustion in rclone 1.75.0's serve S3 multipart upload handler allows remote attackers to exhaust process or hos