CVE-2026-79781: rclone serve s3 Path Traversal via dot-dot object keys
rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in S3 object keys. Attackers can send requests with object keys like ../root-secret.txt to escape the bucket namespace and access files in the serve root directory.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using rclone serve s3 before version 1.74.4 are affected. The exposed files are those in the serve root directory, because dot-dot segments in object keys can escape the intended bucket namespace.
What does an attacker need to exploit this issue?
An attacker needs network access to send requests to the rclone S3 service. No privileges or user interaction are required according to the provided CVSS vector.
What could an attacker do?
An attacker can use object keys containing dot-dot segments, such as ../root-secret.txt, to read and overwrite root-level files in the serve root directory. The reported impact includes low confidentiality and integrity impact, with no availability impact.
How can I determine whether my service may be affected?
Check whether the deployment runs rclone serve s3 on a version earlier than 1.74.4. Review S3 request logs for object keys containing dot-dot path segments, particularly requests resembling ../ followed by a filename.