rclone EUVD-2026-65539

Exploitation requires that the target is actively running the rclone serve s3 subcommand specifically - other rclone commands are not affected. The highest-risk scenario is the default configuration where --auth-key is not set, enabling fully unauthenticated access from any network host; if --auth-key is configured, an attacker must first obtain valid credentials before the traversal is reachable. The traversal is strictly bounded by the configured serve root directory: only files residing at or below the serve root are accessible or modifiable, and arbitrary filesystem paths outside that root cannot be reached. Meaningful exploitation further depends on root-level files existing alongside bucket subdirectories within the serve root - if the serve root contains only bucket directories with no sibling files, the practical read/write impact is reduced. No special platform or OS configuration is required beyond running the affected serve s3 command.

The CVSS 4.0 score of 6.9 reflects a network-accessible (AV:N), low-complexity (AC:L), unauthenticated (PR:N) attack with no user interaction required, yielding low confidentiality and integrity impact (VC:L/VI:L) and no availability impact. The bounded traversal scope - limited strictly to the serve root, not arbitrary filesystem access - justifies the Low impact ratings over High. A public PoC has been confirmed in the GHSA advisory, materially elevating real-world risk above what CVSS alone conveys, as it lowers the attacker skill bar to near-zero. No CISA KEV listing means widespread active exploitation at scale has not been confirmed; EPSS data was not available in the source data. The single most significant risk amplifier is the default unauthenticated configuration: rclone serve s3 permits anonymous access unless --auth-key is explicitly set, meaning any internet-exposed instance is trivially exploitable by any remote actor. The write capability (PUT) compounds the read risk, as root-level file overwrite could enable persistence or configuration tampering depending on what files coexist with the bucket directories at the serve root.

An attacker scans for internet-exposed rclone serve s3 instances (default port 8080) and identifies one running without --auth-key (the default). Using a standard S3 client or a raw HTTP tool, they issue GET /bucket/../credentials.json to retrieve a sensitive file at the serve root that was never intended to be an S3 object. They then issue PUT /bucket/../.ssh/authorized_keys to inject an SSH public key, establishing persistent access to the underlying system. A public PoC is available, making this a script-level attack requiring no specialist knowledge.