CVE-2026-71309 in Rclone
Summary
by MITRE • 08/05/2026
rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.40.0 until 1.75.0, rclone serve restic does not correctly reject URL paths beginning with ../ in cmd/serve/restic/restic.go WithRemote, which accepts a leading parent path and passes it to GET, HEAD, POST, and DELETE handlers for configured backends including WebDAV, FTP, HTTP, Memory, and SFTP. An attacker who can access the REST endpoint may read, create, overwrite, or delete objects outside the path configured by the operator when the operator publishes a backend subdirectory and the backend credential can access parent or sibling objects. This issue is fixed in 1.75.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/05/2026
The vulnerability in rclone affects versions between 1.40.0 and 1.75.0 where the restic server functionality contains a critical path traversal flaw in the cmd/serve/restic/restic.go file. This issue specifically impacts the WithRemote function which fails to properly validate URL paths beginning with ../ sequences, allowing malicious actors to exploit this weakness through the REST endpoint. The vulnerability stems from inadequate input sanitization and path validation mechanisms that permit leading parent directory references to be processed without proper authorization checks.
The technical implementation flaw occurs within the RESTful API handlers that process GET, HEAD, POST, and DELETE operations for various backend storage systems including WebDAV, FTP, HTTP, Memory, and SFTP protocols. When an operator configures a specific subdirectory as a publishing point for a backend, the system should restrict access to only that designated path and its contents. However, due to the missing validation check for parent directory references, attackers can bypass these restrictions and access objects located in parent or sibling directories within the backend storage structure.
This vulnerability directly maps to CWE-22 Path Traversal and aligns with ATT&CK technique T1074 Data Staged, as it enables unauthorized access to sensitive data that should be restricted to specific paths. The operational impact is significant because attackers can perform read operations to access confidential files, create new objects in unauthorized locations, overwrite existing data, or delete critical files outside the intended scope of the configured backend subdirectory. The attack surface expands considerably since any user with access to the REST endpoint can exploit this weakness regardless of their authentication status.
The security implications extend beyond simple file access as this vulnerability enables a range of malicious activities including potential data exfiltration, data corruption, and privilege escalation within the storage system. Attackers could leverage this weakness to access configuration files, credentials, or other sensitive artifacts stored in parent directories that are not intended for public exposure. Organizations using rclone serve restic functionality with exposed REST endpoints face heightened risk of unauthorized data access and potential compliance violations.
Mitigation strategies should prioritize upgrading to version 1.75.0 or later where the path validation has been properly implemented to reject malicious ../ sequences. Network segmentation and access controls should be enforced to limit exposure of the REST endpoint to trusted users only, while implementing proper authentication mechanisms including API keys or token-based authentication. Regular monitoring of access logs for suspicious path traversal attempts can help detect exploitation attempts, and administrators should conduct thorough security audits of their rclone configurations to ensure proper path restrictions are in place. Additionally, organizations should consider implementing network firewalls and intrusion detection systems to monitor for potential exploitation attempts targeting this specific vulnerability pattern.
The vulnerability demonstrates the critical importance of input validation in web applications and API endpoints, particularly when dealing with file system operations. It highlights how seemingly simple path traversal issues can lead to significant security breaches when not properly addressed in the application logic. The fix implemented in version 1.75.0 represents a proper defensive programming approach that enforces strict path validation before processing any user-supplied paths against backend storage systems, thereby preventing unauthorized access to resources outside the intended scope of operation.