EUVD-2026-44533
GHSA-fqj9-69pf-6pjg
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network REST endpoint, low complexity, one low-privilege authenticated account (PR:L) yields full read/overwrite/delete of another user's repo, so C:H/I:H/A:H; scope unchanged as it stays within rclone's data domain.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
4DescriptionCVE.org
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone serve restic --private-repos enforces authorization using the routed user path segment while building the backend object key from the raw uncleaned URL path, allowing an authenticated user to include .. in a request such as //..//config and read, overwrite, or delete another user's private repository on backends that clean path components. This issue is fixed in version 1.74.4.
AnalysisAI
Path traversal in the rclone serve restic --private-repos REST server (versions prior to 1.74.4) allows an authenticated low-privileged user to read, overwrite, or delete another tenant's private restic repository. Authorization is enforced against the routed user path segment, but the backend object key is built from the raw, uncleaned URL path, so a request such as //..//config passes the per-user check while resolving to a different user's data on storage backends that clean path components. No public exploit has been identified at time of analysis, but the fix and a regression test are public in the vendor commits, and EPSS risk is modest (0.52%).
Technical ContextAI
Rclone is a widely used Go command-line tool for syncing to cloud storage; the serve restic subcommand exposes an HTTP REST endpoint implementing the restic backup backend protocol, and --private-repos is meant to sandbox each authenticated user to a repository namespaced by their user ID. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path traversal): in cmd/serve/restic/restic.go, the WithRemote middleware used the router-provided {userID} segment for the authorization decision while constructing the actual backend key from r.URL.Path without canonicalization. Because many storage backends (and path.Clean-style resolution downstream) collapse .. and duplicate slashes, a crafted path like /test/../other_user/config authorizes as test but reads/writes other_user. The fix rejects any non-canonical path where path.Clean(urlpath) != urlpath with HTTP 400, closing the mismatch between the authorized identity and the resolved object key.
RemediationAI
Vendor-released patch: upgrade to rclone 1.74.4 or later, which rejects non-canonical request paths (any path where path.Clean(path) != path, including .. traversal) with HTTP 400; see the fix commits https://github.com/rclone/rclone/commit/015fd0eba1cb138eef081517795fed47a2873f2d and https://github.com/rclone/rclone/commit/dade21c1616035b044df0eef7ee6a85aeb06a139 and advisory GHSA-fqj9-69pf-6pjg. If immediate upgrade is not possible, reduce exposure by restricting network access to the serve restic endpoint (bind to localhost or a trusted management network, or front it with a reverse proxy that normalizes and rejects ../double-slash paths before they reach rclone) and, where feasible, avoid multi-tenant use of --private-repos by giving each user a separate rclone process and isolated backend credentials so a traversal cannot cross a trust boundary. The proxy-normalization workaround has the trade-off that it depends on the proxy's path-cleaning semantics exactly matching the backend's, so it is a stopgap only; patching to 1.74.4 is the reliable fix.
Authentication bypass in rclone's S3 server mode (rclone serve s3) allows any unauthenticated network attacker to impers
PowerShell smart-quote filename injection in rclone's SFTP backend allows an attacker who controls remote filenames to e
An issue was discovered in Rclone before 1.53.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
Cross-session credential isolation failure in rclone's FTP auth-proxy driver (versions 1.64.0-1.75.0) allows an authenti
Symlink escape in rclone's local backend (prior to v1.75.1) allows an attacker who controls sync source contents to appl
FTP CRLF injection in rclone before 1.75.0 allows an attacker who can place crafted filenames in a source namespace to i
Path traversal in rclone prior to 1.75.1 allows an attacker who can populate a source object store with raw `..` key seg
Cleartext disclosure of AWS STS session tokens affects rclone before 1.74.4 when its S3 backend follows a redirect that
Authentication/authorization bypass in rclone's dynamic serve interface (versions 1.70.0 through 1.75.0) lets remote att
Arbitrary file write via symlink traversal in Rclone prior to 1.74.4 lets an attacker-controlled remote escape the local
Memory exhaustion in rclone 1.75.0's serve S3 multipart upload handler allows remote attackers to exhaust process or hos
In Rclone 1.42, use of "rclone sync" to migrate data between two Google Cloud Storage buckets might allow attackers to t
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today