EUVD-2026-75575
GHSA-p6m2-r3w9-mpxw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Network-exposed HTTP/WebDAV endpoint reachable without authentication; impact is per-connection DoS only (A:L), with no confidentiality or integrity loss.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through Object.Open and openTranslatedLink. The function slices the target string as linkdst[offset:], so a Range start larger than the target length causes a deterministic slice-bounds panic when lib/http/serve exposes the object through HTTP or WebDAV. Go net/http normally recovers the panic per connection, causing request-level denial of service rather than terminating the entire process. This issue is fixed in version 1.75.1.
AnalysisAI
Denial of service in rclone prior to 1.75.1 allows unauthenticated remote attackers to crash individual HTTP or WebDAV connections by sending a Range request with an offset exceeding a symlink target's length. When --links or links=true is enabled, symlinks are exposed as .rclonelink pseudo-objects whose content is the target path string; the openTranslatedLink function sliced that string using a caller-controlled offset without bounds validation, producing a deterministic Go slice-bounds panic. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two non-default configuration conditions must both be present: (1) rclone must be running in HTTP or WebDAV serve mode (invoked as `rclone serve http` or `rclone serve webdav`), and (2) symlink translation must be explicitly enabled via the `--links` flag or `links=true` in the backend config - neither is enabled by default. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 5.3 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) is consistent with the mechanics: the endpoint is network-exposed, requires no authentication, and produces only low-severity availability impact because the process continues running. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade rclone to version 1.75.1 or later; the release is available at https://github.com/rclone/rclone/releases/tag/v1.75.1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Authentication bypass in rclone's S3 server mode (rclone serve s3) allows any unauthenticated network attacker to impers
PowerShell smart-quote filename injection in rclone's SFTP backend allows an attacker who controls remote filenames to e
An issue was discovered in Rclone before 1.53.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
Cross-session credential isolation failure in rclone's FTP auth-proxy driver (versions 1.64.0-1.75.0) allows an authenti
Symlink escape in rclone's local backend (prior to v1.75.1) allows an attacker who controls sync source contents to appl
FTP CRLF injection in rclone before 1.75.0 allows an attacker who can place crafted filenames in a source namespace to i
Path traversal in rclone prior to 1.75.1 allows an attacker who can populate a source object store with raw `..` key seg
Cleartext disclosure of AWS STS session tokens affects rclone before 1.74.4 when its S3 backend follows a redirect that
Authentication/authorization bypass in rclone's dynamic serve interface (versions 1.70.0 through 1.75.0) lets remote att
Path traversal in the `rclone serve restic --private-repos` REST server (versions prior to 1.74.4) allows an authenticat
Arbitrary file write via symlink traversal in Rclone prior to 1.74.4 lets an attacker-controlled remote escape the local
Memory exhaustion in rclone 1.75.0's serve S3 multipart upload handler allows remote attackers to exhaust process or hos
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today