rclone CVE-2026-71312

Three specific non-default conditions must all be present: (1) the SFTP remote's SSH command shell must be PowerShell - standard POSIX/OpenSSH deployments using bash or sh are entirely unaffected, as the Unicode quoting issue is PowerShell-specific; (2) SSH exec must be enabled on the SFTP server; and (3) rclone must invoke server-side hashing for the affected remote, either explicitly configured or via autodetection. Beyond server configuration, the attacker must have the ability to create or rename files on the SFTP remote - qualifying roles include an authorized SFTP collaborator, an upstream storage source under attacker influence, or any party with remote write/rename capability. What limits exploitation: the PR:L CVSS metric confirms authenticated access is required; UI:R confirms the victim must actively trigger a hash operation; and the PowerShell shell requirement restricts the vulnerable population to Windows-hosted or explicitly PowerShell-configured SFTP deployments. Unauthenticated or fully passive exploitation is not possible.

The vendor-assigned CVSS 8.0 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) reflects high impact but may overstate real-world exploitability. The PR:L metric confirms some level of authenticated access is required - the attacker must have the ability to create or rename files on the SFTP remote. UI:R is a meaningful constraint: the victim must actively invoke server-side hashing, not merely connect to the remote. Most critically, exploitation requires a non-default deployment condition - PowerShell must be the SSH command shell, a configuration typical of Windows-hosted SFTP servers but uncommon on standard POSIX environments. These factors combined suggest the realistic attack surface is substantially narrower than a raw 8.0 implies. A proof-of-concept was demonstrated in the GHSA advisory, confirming the issue is exploitable in practice, but no EPSS score or CISA KEV listing was provided, leaving broader exploitation probability unconfirmed. This is a genuine high-severity issue for affected configurations but not broadly applicable across all rclone deployments.

An attacker with SFTP write access to a Windows-hosted SFTP server creates a file whose name contains a Unicode smart quote (e.g., U+2019 ') followed by a semicolon and a PowerShell payload such as an outbound HTTP beacon or lateral-movement command. When the victim runs rclone with server-side hashing enabled against that remote, rclone constructs a PowerShell Get-FileHash command incorporating the malicious filename - the smart quote closes the path literal, and the injected statement executes as the victim's SSH account on the server. A proof-of-concept using a harmless Set-Content marker and the production Object.Hash code path was confirmed in the GHSA advisory.