CVE-2026-93986: rclone before 1.75.1 Path Traversal via Directory Listing Names
rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allowing path traversal sequences in object names. Attackers can craft special names containing forward slashes and parent directory references to potentially write outside the destination root, though downstream protections in the local backend currently block actual file escape.
Affected Software
Event History
Frequently Asked Questions
Which installations should be prioritized for review?
Review rclone installations running versions before 1.75.1, particularly where rclone consumes directory listings from servers or third-party sources that may be attacker-controlled or untrusted.
What must an attacker control to attempt exploitation?
An attacker needs to supply a directory listing entry with a specially crafted object name containing forward slashes and parent-directory references. The vulnerable rclone instance must process that listing while writing to a destination.
What is the practical impact if patching cannot happen immediately?
The local backend currently has downstream protections that block an actual file escape outside the destination root. This limits the described impact, but upgrading to 1.75.1 or later is still needed to correct the insufficient name confinement.
How can I determine whether an environment is affected?
Check the installed rclone version and identify workflows that copy or sync from remote or third-party directory listings. Versions before 1.75.1 that process untrusted listing names are affected by the name-validation issue.