Rclone CVE-2026-116191

Requires that 'rclone serve webdav' be running and reachable by the attacker; the advisory states this is the one front-end in cmd/serve/ lacking a path guard (serve restic/s3/docker have rclone's own guard, and serve ftp/sftp/nfs are confined by third-party libraries), so serve ftp/sftp/http/webdav-style backends that join root-with-remote before encoding are the ones that resolve the '..' away. No authentication is needed (PR:N confirmed by the CVSS vector) and it works against default configurations - default --dir-cache-time is 5 minutes and the poisoned node is trivially re-planted, so there is no timing window to miss. Exploitation is write-oriented only: creation, overwrite, MOVE/COPY-out, PROPPATCH, and (after a client PUT) deletion by known name all succeed above the root, but reading or enumerating files the attacker did not itself write is refused (GET/PROPFIND return 404) because the read path runs entries through RemoteEscapesRoot/RemoveEscaping. The practical limiter on impact is deployment: the flaw is only meaningful where untrusted clients can reach the WebDAV listener and share a backend root with other tenants' data.

This is a genuine, near-term priority rather than a high-CVSS-but-low-real-risk issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) is confirmed by the input and is fully consistent with the mechanism the GHSA advisory describes: two unauthenticated HTTP requests (MKCOL /.. then a write verb) succeed against a default 'rclone serve webdav' deployment with no authentication, no user interaction, and low complexity. Impact is scoped to integrity (VI:H) - the advisory shows the read path is closed by rclone's own August fix (GET/PROPFIND above the root return 404), so there is no confidentiality loss (VC:N), and availability of the service is not directly degraded (VA:N), though arbitrary file overwrite/deletion of other tenants' data is a serious integrity consequence. The vuln.today decision label is 'this_week', reported by VulnCheck, which signals elevated but not emergency urgency. No CISA KEV listing is present in the input and no EPSS score was supplied, so there is no evidence of active or widespread exploitation at this time - the priority rests on the trivial exploitability and the detailed, reproducible write-up rather than on observed in-the-wild activity. The main factor that moderates real-world risk is exposure: the flaw only matters where 'serve webdav' is actually reachable by untrusted clients (notably multi-tenant or shared-root setups), not for the far more common use of rclone as a local sync CLI.

An attacker who can reach an exposed, unauthenticated 'rclone serve webdav' instance sends MKCOL /.. to plant a VFS directory node whose backend path is literally '..', then issues PUT/MOVE/COPY/MKCOL/DELETE requests prefixed with /../ to create, overwrite, or delete files above the served root - including files belonging to other tenants sharing the same backend. The GHSA advisory includes a full, executed reproduction (against released binary v1.75.1 and a master build), so a working proof-of-concept is documented in detail. Because the planted node is low-complexity and re-plantable in one request, the write succeeds reliably whenever the MKCOL immediately precedes the write.