rclone CVE-2026-93986

Requires the victim to run rclone (before 1.75.1) transferring data FROM a remote or third-party server that the attacker controls or has compromised, such that the attacker can dictate object names returned in directory-listing responses. The attacker must craft names embedding forward slashes and '../' parent references to attempt escape from the destination root. Exploitation is strongly limited: it depends on user interaction (running the transfer, UI:P), a specific attacker-controlled-source precondition (AT:P), and high complexity (AC:H); moreover, the local backend's existing downstream protections currently block actual file escape, so a successful write outside the destination root is not presently demonstrated against the default local backend.

This is a low-priority, defense-in-depth hardening fix rather than an actionable threat. The vendor CVSS 4.0 score is only 2.3 (LOW) with vector AV:N/AC:H/AT:P/PR:N/UI:P and impact limited to VI:L (integrity-low) - no confidentiality or availability impact. Critically, the description itself states that 'downstream protections in the local backend currently block actual file escape,' meaning the primary exploitable consequence (writing outside the destination root) is already mitigated in practice; this CVE fixes the traversal at the name-confinement layer as an additional barrier. There is no EPSS score, no CISA KEV listing, and no public exploit code identified at time of analysis - no public exploit identified at time of analysis. The signals are internally consistent: high attack complexity (AC:H), a required attack condition (AT:P), and required user interaction (UI:P) all point to a scenario that is hard to trigger and low-impact even if triggered. This is a high-quality upstream hardening advisory (VulnCheck + GHSA), not a widespread-exploitation concern.

An attacker who controls or has compromised a cloud storage remote (or a third-party server whose listing responses rclone consumes) returns object names containing embedded forward slashes and '../' parent-directory references. When a victim runs rclone to sync or copy from that malicious remote to a local destination, rclone fails to confine those names to the listed directory and attempts to write them outside the destination root. In current versions the local backend's downstream checks block the actual file escape, so this is presently a defense-in-depth gap rather than a working write-outside-root primitive; no public exploit code is identified.