CVE-2026-93987: rclone serve docker Path Traversal via Volume Name
rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in the rclone serve docker volume plugin. newVolume() in cmd/serve/docker/volume.go computes a volume's mountpoint as filepath.Join(drv.root, name) from the attacker-supplied name field of a Docker VolumeDriver.Create request without verifying that the result stays within drv.root (default /var/lib/docker-volumes/rclone), and checkMountpoint() then creates that directory with file.MkdirAll before mounting. A volume name containing enough .. components (e.g. "../../../../../../etc") therefore resolves outside the base directory, allowing anyone able to submit a VolumeDriver.Create request to the plugin socket — normally the Docker daemon, or a workload that can request named volumes in a multi-tenant orchestration setup — to make the privileged rclone plugin process create a directory and mount a remote filesystem specified in the same request at an arbitrary host path, shadowing or disrupting system directories. The advisory notes Volume.restoreState() had the same missing validation when reloading persisted volume state. Fixed in 1.75.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rcloneto a version that resolves this vulnerability.Fixed in 1.75.1
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must be able to submit a Docker VolumeDriver.Create request to the rclone plugin socket. This is normally the Docker daemon, but workloads that can request named volumes in a multi-tenant orchestration environment may also be able to trigger it.
Are default deployments affected?
The vulnerable mountpoint calculation uses the plugin root directory, whose default is /var/lib/docker-volumes/rclone. A deployment is affected when it runs rclone serve docker in versions 1.56.0 through 1.75.0 and accepts attacker-controlled volume names through the Docker volume driver.
What can an attacker do after exploitation?
By using a volume name with sufficient .. path components, an attacker can cause the privileged plugin to create a directory and mount a remote filesystem at an arbitrary host path. This can shadow or disrupt system directories.
What should be done if immediate patching is not possible?
Restrict access so untrusted users or workloads cannot submit VolumeDriver.Create requests or request named volumes through the affected plugin. This reduces exposure until upgrading to version 1.75.1.
Could persisted volume state also be dangerous?
Yes. The advisory states that Volume.restoreState() lacked the same path validation when reloading persisted volume state, so previously persisted malicious volume names may be processed during state restoration.