CVE-2026-116191 in Rclone
Summary
by MITRE • 10/25/2026
Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send MKCOL /.. to plant a VFS node, then PUT, MOVE, COPY, or MKCOL to create, overwrite, or delete files belonging to other tenants.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/25/2026
The vulnerability identified in Rclone versions prior to 1.75.2 represents a critical path traversal flaw within the WebDAV serving functionality. This security defect arises from insufficient validation of user-supplied input specifically regarding directory traversal sequences, such as double-dot notation used to navigate up the file system hierarchy. When an unauthenticated attacker interacts with the serve webdav endpoint, they can exploit this lack of sanitization by injecting path components that escape the intended root directory context. The core technical failure lies in the application's inability to properly resolve or restrict paths relative to the configured serving root, allowing operations to target locations outside the designated sandboxed environment.
From an operational perspective, this vulnerability enables severe unauthorized access and data manipulation capabilities for any actor with network connectivity to the WebDAV service. By sending a MKCOL request targeting a parent directory path like /.., an attacker can create virtual file system nodes above the served root. Once these external nodes are established, subsequent operations such as PUT, MOVE, COPY, or additional MKCOL requests allow the attacker to write arbitrary files, overwrite existing data belonging to other tenants, or delete critical resources. In multi-tenant environments where Rclone is used to serve shared storage, this flaw effectively breaks isolation guarantees, leading to potential cross-tenant data leakage and integrity compromise.
This issue aligns with Common Weakness Enumeration CWE-22, which defines Improper Limitation of a Pathname to a Restricted Directory. The exploitation technique mirrors the initial stages of file inclusion or directory traversal attacks often cataloged under MITRE ATT&CK techniques related to Command and Control or Data Exfiltration via shared channels, although in this specific context, it is primarily an integrity and confidentiality violation within a storage service rather than traditional command execution. The ability to write outside the root directory fundamentally undermines the security model of any system relying on Rclone for secure file serving.
To mitigate this risk, organizations must immediately upgrade Rclone to version 1.75.2 or later, where these path validation checks have been corrected. For environments that cannot be updated instantly due to dependency constraints, deploying a reverse proxy with strict URL rewriting rules can help sanitize incoming requests before they reach the application layer. Additionally, implementing network-level access controls such as IP whitelisting for WebDAV endpoints reduces the attack surface by restricting exposure to unauthenticated users. Regular auditing of file system permissions and monitoring for anomalous directory creation patterns above expected roots can also aid in early detection of exploitation attempts.