rclone EUVD-2026-65539

PowerShell smart-quote filename injection in rclone's SFTP backend allows an attacker who controls remote filenames to e

An issue was discovered in Rclone before 1.53.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita

FTP CRLF injection in rclone before 1.75.0 allows an attacker who can place crafted filenames in a source namespace to i

Cleartext disclosure of AWS STS session tokens affects rclone before 1.74.4 when its S3 backend follows a redirect that

Path traversal in the `rclone serve restic --private-repos` REST server (versions prior to 1.74.4) allows an authenticat

Arbitrary file write via symlink traversal in Rclone prior to 1.74.4 lets an attacker-controlled remote escape the local

In Rclone 1.42, use of "rclone sync" to migrate data between two Google Cloud Storage buckets might allow attackers to t

Denial-of-service vulnerabilities in rclone's archive backend SquashFS parser allow an attacker with write access to rcl

Unauthenticated credential exposure in rclone before 1.75.0 allows remote attackers to retrieve backend storage secrets

Credential exposure in rclone's WebDAV backend allows an adjacent on-path attacker to capture and replay Basic authentic

Credential exposure in rclone before v1.75.0 allows network-adjacent attackers to capture IBM IAM bearer tokens during s

Rclone before v1.75.0 panics in the WebDAV TUS creation handler when a transport failure returns a nil HTTP response, be