CVE-2026-116191: Rclone before 1.75.2 Path Traversal via serve webdav MKCOL

Q: Which deployments are exposed?

Deployments using Rclone serve webdav before version 1.75.2 are exposed. The issue affects the served WebDAV root and can impact files belonging to other tenants when they are reachable above that root.

Q: Does exploitation require authentication or user interaction?

No. The vulnerability is remotely exploitable by an unauthenticated attacker and requires neither privileges nor user interaction.

Q: What request sequence can an attacker use?

An attacker can send MKCOL /.. to plant a VFS node above the served root. They can then use PUT, MOVE, COPY, or additional MKCOL requests to create, overwrite, or delete files.

Q: What is the available remediation?

Upgrade Rclone to version 1.75.2 or later. The affected versions are those before 1.75.2.

Published Oct 25, 2026

Updated

Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send MKCOL /.. to plant a VFS node, then PUT, MOVE, COPY, or MKCOL to create, overwrite, or delete files belonging to other tenants.

Affected Software

1 affected component

Rclone Rclone<1.75.2

Event History

Oct 25, 2026

CVE Published

via MITRE·01:20 PM

Data Sourced

via MITRE·01:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Deployments using Rclone serve webdav before version 1.75.2 are exposed. The issue affects the served WebDAV root and can impact files belonging to other tenants when they are reachable above that root.

Does exploitation require authentication or user interaction?

No. The vulnerability is remotely exploitable by an unauthenticated attacker and requires neither privileges nor user interaction.

What request sequence can an attacker use?

An attacker can send MKCOL /.. to plant a VFS node above the served root. They can then use PUT, MOVE, COPY, or additional MKCOL requests to create, overwrite, or delete files.

What is the available remediation?

Upgrade Rclone to version 1.75.2 or later. The affected versions are those before 1.75.2.

CVE-2026-116191: Rclone before 1.75.2 Path Traversal via serve webdav MKCOL

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed?

Does exploitation require authentication or user interaction?

What request sequence can an attacker use?

What is the available remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

Does exploitation require authentication or user interaction?

What request sequence can an attacker use?

What is the available remediation?