CVE-2026-71312 in Rclone
Summary
by MITRE • 08/06/2026
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP paths into PowerShell hash commands in backend/sftp/sftp.go, and quoteOrEscapeShellPath escapes only ASCII apostrophe even though PowerShell treats U+2018, U+2019, U+201A, and U+201B as single-quote delimiters, allowing an attacker-controlled filename to terminate the intended path literal and append PowerShell statements that execute as the victim SSH account when server-side hashing is invoked. This issue is fixed in v1.75.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/06/2026
The vulnerability in rclone affects versions prior to 1.75.0 and stems from improper handling of SFTP remote paths during PowerShell command interpolation within the backend/sftp/sftp.go file. This flaw represents a classic command injection vulnerability that occurs when user-controlled filenames are not adequately sanitized before being embedded into shell commands. The technical implementation uses quoteOrEscapeShellPath function which only escapes ASCII apostrophe characters, failing to account for Unicode single quotation marks including U+2018, U+2019, U+201A, and U+201B that PowerShell also recognizes as delimiters. When server-side hashing operations are invoked, these unescaped Unicode quotes can terminate intended path literals and allow arbitrary PowerShell commands to be appended and executed with the privileges of the victim SSH account.
The operational impact of this vulnerability is significant as it enables remote code execution in scenarios where rclone operates in environments that support PowerShell command execution. Attackers can craft malicious filenames containing Unicode single quotes that exploit the interpolation flaw, effectively bypassing standard input sanitization measures. This creates a privilege escalation vector where an attacker with access to upload files to SFTP servers can execute arbitrary commands as the SSH user context, potentially leading to full system compromise or lateral movement within network environments. The vulnerability specifically affects systems where rclone's SFTP backend processes filenames through PowerShell hash commands, making it particularly dangerous in enterprise environments that rely on both SFTP synchronization and PowerShell-based security measures.
Security mitigation involves upgrading to rclone version 1.75.0 or later where the fix properly handles all Unicode single quotation marks in the path escaping mechanism. Organizations should also implement strict file naming policies and validate all filenames before upload to SFTP servers, particularly when these files may be processed through hash operations. Network segmentation and privilege separation can help minimize the impact of successful exploitation by limiting the scope of what an attacker can achieve with elevated privileges. The vulnerability aligns with CWE-78 (Improper Neutralization of Special Elements used in OS Command) and maps to ATT&CK technique T1059.001 (Command and Scripting Interpreter: PowerShell), highlighting the intersection of command injection and PowerShell abuse vectors in cloud storage synchronization tools.
The fix implemented in version 1.75.0 demonstrates proper input sanitization by expanding the escape sequence to include all Unicode single quotation marks recognized by PowerShell rather than relying solely on ASCII character handling. This represents a comprehensive approach to addressing internationalized character set vulnerabilities that commonly appear in shell command injection scenarios. The solution aligns with industry best practices for secure coding and demonstrates the importance of considering all character representations when implementing shell escaping mechanisms, particularly in cross-platform applications that interface with multiple operating system command interpreters. Organizations should verify their rclone installations are updated and review any custom configurations or scripts that might interact with SFTP paths to ensure complete protection against this class of vulnerability.